Edit tour

Windows Analysis Report
soft 1.14.exe

Overview

General Information

Sample name:	soft 1.14.exe
Analysis ID:	1581513
MD5:	9d28b3f2746f719fe82a21428f9265ae
SHA1:	3acd169f55124db5b2d46a95ffdd48d5a57e3c11
SHA256:	2b1545089a5a1be6fe2ce0fa399d982b4b7995a750a1ea0528695c7eed5f24d4
Tags:	exeMeduzaStealeruser-ventoy
Infos:

Detection

Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Self deletion via cmd or bat file

Sigma detected: Suspicious Ping/Del Command Combination

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

soft 1.14.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\soft 1.14.exe" MD5: 9D28B3F2746F719FE82A21428F9265AE)

soft 1.14.exe (PID: 7544 cmdline: "C:\Users\user\Desktop\soft 1.14.exe" MD5: 9D28B3F2746F719FE82A21428F9265AE)

cmd.exe (PID: 7784 cmdline: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7836 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "147.45.44.216", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "423", "self_destruct": true, "extensions": "", "links": "", "grabber_max_size": 1048576}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000001.00000003.1849372179.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x11292c:$str01: emoji 0x1154b8:$str02: %d-%m-%Y, %H:%M:%S 0x115528:$str03: [UTC 0x115530:$str04: user_name 0x115578:$str05: computer_name 0x115550:$str06: timezone 0x115488:$str07: current_path() 0x1128f0:$str08: [json.exception. 0x12cf12:$str09: GDI32.dll 0x12d184:$str10: GdipGetImageEncoders 0x12d1fc:$str10: GdipGetImageEncoders 0x12c7b0:$str11: GetGeoInfoA
Process Memory Space: soft 1.14.exe PID: 7544	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: soft 1.14.exe PID: 7544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.soft 1.14.exe.140000000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
1.2.soft 1.14.exe.140000000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x11152c:$str01: emoji 0x1140b8:$str02: %d-%m-%Y, %H:%M:%S 0x114128:$str03: [UTC 0x114130:$str04: user_name 0x114178:$str05: computer_name 0x114150:$str06: timezone 0x114088:$str07: current_path() 0x1114f0:$str08: [json.exception. 0x12bb12:$str09: GDI32.dll 0x12bd84:$str10: GdipGetImageEncoders 0x12bdfc:$str10: GdipGetImageEncoders 0x12b3b0:$str11: GetGeoInfoA
1.2.soft 1.14.exe.140000000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
1.2.soft 1.14.exe.140000000.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x11292c:$str01: emoji 0x1154b8:$str02: %d-%m-%Y, %H:%M:%S 0x115528:$str03: [UTC 0x115530:$str04: user_name 0x115578:$str05: computer_name 0x115550:$str06: timezone 0x115488:$str07: current_path() 0x1128f0:$str08: [json.exception. 0x12cf12:$str09: GDI32.dll 0x12d184:$str10: GdipGetImageEncoders 0x12d1fc:$str10: GdipGetImageEncoders 0x12c7b0:$str11: GetGeoInfoA

Sigma Signatures

System Summary

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\soft 1.14.exe", ParentImage: C:\Users\user\Desktop\soft 1.14.exe, ParentProcessId: 7544, ParentProcessName: soft 1.14.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe", ProcessId: 7784, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:40:02.512809+0100	2046303	1	A Network Trojan was detected	192.168.2.4	49730	147.45.44.216	15666	TCP
2024-12-27T23:40:02.632795+0100	2046303	1	A Network Trojan was detected	192.168.2.4	49730	147.45.44.216	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T23:40:02.512809+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	147.45.44.216	15666	TCP
2024-12-27T23:40:02.632795+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	147.45.44.216	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.soft 1.14.exe.140000000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "147.45.44.216", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "423", "self_destruct": true, "extensions": "", "links": "", "grabber_max_size": 1048576}

Multi AV Scanner detection for submitted file

Source: soft 1.14.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.7% probability

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140076AA0 CryptUnprotectData,LocalFree,	1_2_0000000140076AA0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400D3090 CryptUnprotectData,	1_2_00000001400D3090
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400772C0 BCryptCloseAlgorithmProvider,	1_2_00000001400772C0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140077340 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,Concurrency::cancel_current_task,	1_2_0000000140077340
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400D3658 BCryptCloseAlgorithmProvider,	1_2_00000001400D3658
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140033A30 BCryptDestroyKey,	1_2_0000000140033A30
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140036C90 CryptUnprotectData,LocalFree,	1_2_0000000140036C90
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140076DC0 CryptProtectData,LocalFree,	1_2_0000000140076DC0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140076F20 BCryptDecrypt,BCryptDecrypt,	1_2_0000000140076F20

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: soft 1.14.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF60807CA90 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF60807CA90
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400B9DB8 FindClose,FindFirstFileExW,GetLastError,	1_2_00000001400B9DB8
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400D3100 FindFirstFileW,	1_2_00000001400D3100
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400B9E68 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	1_2_00000001400B9E68
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF60807CAF1 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF60807CAF1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2046303 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M1 : 192.168.2.4:49730 -> 147.45.44.216:15666

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 147.45.44.216:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 147.45.44.216:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.216

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_00000001400840A0 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

1_2_00000001400840A0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: soft 1.14.exe, 00000001.00000003.1849179322.00000298335F0000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1849212145.00000298335F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: soft 1.14.exe, 00000001.00000003.1698661565.00000298335E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi;
Source: soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/c
Source: soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: soft 1.14.exe, 00000001.00000003.1700540417.0000029833836000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700219103.0000029833835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: soft 1.14.exe, 00000001.00000003.1700540417.0000029833836000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700219103.0000029833835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: soft 1.14.exe, 00000001.00000003.1700540417.0000029833836000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700219103.0000029833835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: soft 1.14.exe, 00000001.00000003.1706893890.0000029833F8D000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CC7000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833834000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.0000029833946000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C48000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CBF000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.000002983393E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.000002983383C000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833855000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833819000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1701445096.0000029830D2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833855000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833819000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1701445096.0000029830D2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: soft 1.14.exe, 00000001.00000003.1706893890.0000029833F8D000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CC7000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833834000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.0000029833946000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C48000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CBF000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.000002983393E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.000002983383C000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: soft 1.14.exe, 00000001.00000003.1706278412.0000029833CFD000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.000002983394E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CCE000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833843000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: soft 1.14.exe, 00000001.00000003.1706278412.0000029833CFD000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.000002983394E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CCE000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833843000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_00000001400849D0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_00000001400849D0

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.soft 1.14.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 1.2.soft 1.14.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400D3718 NtQueryObject,	1_2_00000001400D3718
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400888E0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	1_2_00000001400888E0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140088FE0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	1_2_0000000140088FE0

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF608072DD0	0_2_00007FF608072DD0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF60807CA90	0_2_00007FF60807CA90
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF608077008	0_2_00007FF608077008
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400840A0	1_2_00000001400840A0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400320B0	1_2_00000001400320B0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014008B17B	1_2_000000014008B17B
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140086250	1_2_0000000140086250
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140065250	1_2_0000000140065250
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400442D0	1_2_00000001400442D0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140030450	1_2_0000000140030450
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014003C5E0	1_2_000000014003C5E0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014003D680	1_2_000000014003D680
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400856C0	1_2_00000001400856C0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A16FC	1_2_00000001400A16FC
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014002F730	1_2_000000014002F730
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014007B7D0	1_2_000000014007B7D0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140064870	1_2_0000000140064870
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400849D0	1_2_00000001400849D0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140097A4C	1_2_0000000140097A4C
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014003BA80	1_2_000000014003BA80
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140034B70	1_2_0000000140034B70
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140031B90	1_2_0000000140031B90
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140086BE0	1_2_0000000140086BE0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014008BC00	1_2_000000014008BC00
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140032CA0	1_2_0000000140032CA0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014003DD20	1_2_000000014003DD20
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140050D9A	1_2_0000000140050D9A
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014002FE20	1_2_000000014002FE20
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140048E80	1_2_0000000140048E80
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014007DF10	1_2_000000014007DF10
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400BEF18	1_2_00000001400BEF18
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014006BF80	1_2_000000014006BF80
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014005AFF0	1_2_000000014005AFF0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014009405C	1_2_000000014009405C
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014009E0A6	1_2_000000014009E0A6
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400070E0	1_2_00000001400070E0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014006F1C0	1_2_000000014006F1C0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014007D1E0	1_2_000000014007D1E0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400991E4	1_2_00000001400991E4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400752A6	1_2_00000001400752A6
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014007A320	1_2_000000014007A320
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014005B320	1_2_000000014005B320
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140089330	1_2_0000000140089330
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A5328	1_2_00000001400A5328
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014005A380	1_2_000000014005A380
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400853A0	1_2_00000001400853A0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400283D0	1_2_00000001400283D0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400AA450	1_2_00000001400AA450
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140026510	1_2_0000000140026510
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140025520	1_2_0000000140025520
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014008F5D4	1_2_000000014008F5D4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140097610	1_2_0000000140097610
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140006610	1_2_0000000140006610
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140053620	1_2_0000000140053620
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140061650	1_2_0000000140061650
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014005A680	1_2_000000014005A680
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400BE87C	1_2_00000001400BE87C
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014003893D	1_2_000000014003893D
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A1978	1_2_00000001400A1978
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014009D998	1_2_000000014009D998
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400749B0	1_2_00000001400749B0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014005A9B0	1_2_000000014005A9B0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014005F9C0	1_2_000000014005F9C0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400509F0	1_2_00000001400509F0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400AA9E8	1_2_00000001400AA9E8
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140077A00	1_2_0000000140077A00
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140091A10	1_2_0000000140091A10
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140094A24	1_2_0000000140094A24
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140033A30	1_2_0000000140033A30
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140030A80	1_2_0000000140030A80
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A5A98	1_2_00000001400A5A98
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014008FAE0	1_2_000000014008FAE0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140056BEB	1_2_0000000140056BEB
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140073C40	1_2_0000000140073C40
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140093C54	1_2_0000000140093C54
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A8C88	1_2_00000001400A8C88
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014005ACD0	1_2_000000014005ACD0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014007FCF0	1_2_000000014007FCF0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A8D0F	1_2_00000001400A8D0F
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140006D20	1_2_0000000140006D20
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014009FDA4	1_2_000000014009FDA4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140005DB0	1_2_0000000140005DB0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140074DF0	1_2_0000000140074DF0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140039E40	1_2_0000000140039E40
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140093E58	1_2_0000000140093E58
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400B9E68	1_2_00000001400B9E68
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140030E80	1_2_0000000140030E80
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140036EE0	1_2_0000000140036EE0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140094F2C	1_2_0000000140094F2C
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A6F34	1_2_00000001400A6F34
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A1F68	1_2_00000001400A1F68
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400A2FA4	1_2_00000001400A2FA4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014003AFB0	1_2_000000014003AFB0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140088FE0	1_2_0000000140088FE0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF60807CAF1	1_2_00007FF60807CAF1
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF608072DD0	1_2_00007FF608072DD0

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: String function: 000000014002E1D0 appears 33 times
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: String function: 0000000140096B14 appears 35 times
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: String function: 000000014002BA80 appears 32 times
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: String function: 00000001400475F0 appears 60 times

Source: soft 1.14.exe, 00000001.00000003.1848741263.0000029833823000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs soft 1.14.exe
Source: soft 1.14.exe, 00000001.00000003.1848741263.0000029833823000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs soft 1.14.exe
Source: soft 1.14.exe, 00000001.00000003.1849283468.0000029833824000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs soft 1.14.exe
Source: soft 1.14.exe, 00000001.00000003.1849283468.0000029833824000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs soft 1.14.exe

Source: 1.2.soft 1.14.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 1.2.soft 1.14.exe.140000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/1@1/2

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_000000014008A560 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		1_2_000000014008A560
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400D3008 AdjustTokenPrivileges,CredEnumerateA,		1_2_00000001400D3008

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_000000014003D680 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_000000014003D680

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_0000000140073C40 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

1_2_0000000140073C40

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03
Source: C:\Users\user\Desktop\soft 1.14.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963C3CFE079

Source: soft 1.14.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\soft 1.14.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: soft 1.14.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\soft 1.14.exe "C:\Users\user\Desktop\soft 1.14.exe"
Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: C:\Users\user\Desktop\soft 1.14.exe "C:\Users\user\Desktop\soft 1.14.exe"
Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: C:\Users\user\Desktop\soft 1.14.exe "C:\Users\user\Desktop\soft 1.14.exe"	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: soft 1.14.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: soft 1.14.exe

Static file information: File size 3276800 > 1048576

Source: soft 1.14.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x309c00

Source: soft 1.14.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: soft 1.14.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: soft 1.14.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: soft 1.14.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: soft 1.14.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: soft 1.14.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_000000014003C5E0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_000000014003C5E0

Source: soft 1.14.exe	Static PE information: section name: .00cfg
Source: soft 1.14.exe	Static PE information: section name: .gxfg
Source: soft 1.14.exe	Static PE information: section name: .retplne
Source: soft 1.14.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_000000014004CBE2 push rbp; retf

1_2_000000014004CBE5

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_000000014007B500 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

1_2_000000014007B500

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe"
Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe"			Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000			Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-74111

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF60807CA90 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF60807CA90
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400B9DB8 FindClose,FindFirstFileExW,GetLastError,	1_2_00000001400B9DB8
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400D3100 FindFirstFileW,	1_2_00000001400D3100
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400B9E68 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	1_2_00000001400B9E68
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF60807CAF1 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF60807CAF1

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_00000001400978F8 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

1_2_00000001400978F8

Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1699258652.0000029830D20000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000002.1850037500.0000029830D1E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1849372179.0000029830D1E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\soft 1.14.exe	API call chain: ExitProcess graph end node			graph_1-74056
Source: C:\Users\user\Desktop\soft 1.14.exe	API call chain: ExitProcess graph end node			graph_1-74051

Source: C:\Users\user\Desktop\soft 1.14.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_00000001400D3700 LdrEnumerateLoadedModules,

1_2_00000001400D3700

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 0_2_00007FF608077760 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF608077760

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_00000001400BC0C4 GetLastError,IsDebuggerPresent,OutputDebugStringW,

1_2_00000001400BC0C4

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_000000014003C5E0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_000000014003C5E0

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 0_2_00007FF608079E10 GetProcessHeap,

0_2_00007FF608079E10

Source: C:\Users\user\Desktop\soft 1.14.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF608077760 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF608077760
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF6080754D4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6080754D4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF6080754C4 SetUnhandledExceptionFilter,	0_2_00007FF6080754C4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 0_2_00007FF60807C0E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF60807C0E8
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400D32D8 SetUnhandledExceptionFilter,	1_2_00000001400D32D8
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_0000000140096828 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0000000140096828
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400ADB78 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00000001400ADB78
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00000001400ADD58 SetUnhandledExceptionFilter,	1_2_00000001400ADD58
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF60807C0E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF60807C0E8
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF6080754D4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6080754D4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF6080754C4 SetUnhandledExceptionFilter,	1_2_00007FF6080754C4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: 1_2_00007FF608077760 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF608077760

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\soft 1.14.exe

Memory written: C:\Users\user\Desktop\soft 1.14.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\soft 1.14.exe

Thread register set: target process: 7544

Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_000000014007A320 ShellExecuteW,

1_2_000000014007A320

Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: C:\Users\user\Desktop\soft 1.14.exe "C:\Users\user\Desktop\soft 1.14.exe"	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 0_2_00007FF6080817D0 cpuid

0_2_00007FF6080817D0

Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: EnumSystemLocalesW,	1_2_000000014009C3A0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: GetLocaleInfoW,	1_2_00000001400D3398
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_00000001400A74C4
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: EnumSystemLocalesW,	1_2_00000001400A7820
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: GetLocaleInfoW,	1_2_000000014009C8E0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: EnumSystemLocalesW,	1_2_00000001400A78F0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_00000001400A7988
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: GetLocaleInfoEx,FormatMessageA,	1_2_00000001400B9A28
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: GetLocaleInfoW,	1_2_00000001400A7BD0
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00000001400A7D28
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: GetLocaleInfoW,	1_2_00000001400A7DD8
Source: C:\Users\user\Desktop\soft 1.14.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00000001400A7F0C

Source: C:\Users\user\Desktop\soft 1.14.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 0_2_00007FF608075304 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF608075304

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_0000000140084FB0 GetUserNameW,

1_2_0000000140084FB0

Source: C:\Users\user\Desktop\soft 1.14.exe

Code function: 1_2_0000000140086250 GetTimeZoneInformation,

1_2_0000000140086250

Stealing of Sensitive Information

Yara detected Meduza Stealer

Source: Yara match	File source: 1.2.soft 1.14.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.soft 1.14.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1849372179.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: soft 1.14.exe PID: 7544, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\wallets
Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: soft 1.14.exe, 00000001.00000003.1712211281.0000029830D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet18n
Source: soft 1.14.exe, 00000001.00000003.1712211281.0000029830D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystoreata
Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: soft 1.14.exe, 00000001.00000003.1712211281.0000029830D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonbldb5*
Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: soft 1.14.exe, 00000001.00000003.1712211281.0000029830D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Neon
Source: soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\soft 1.14.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\soft 1.14.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\soft 1.14.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: soft 1.14.exe PID: 7544, type: MEMORYSTR

Remote Access Functionality

Yara detected Meduza Stealer

Source: Yara match	File source: 1.2.soft 1.14.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.soft 1.14.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1849372179.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: soft 1.14.exe PID: 7544, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 File Deletion	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	211 Process Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
soft 1.14.exe	47%	ReversingLabs	Win64.Trojan.Generic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://ns.microsoft.t/Regi;	0%	Avira URL Cloud	safe
http://ns.microsoft.t/Regi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	soft 1.14.exe, 00000001.00000003.1700540417.0000029833836000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700219103.0000029833835000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	soft 1.14.exe, 00000001.00000003.1700540417.0000029833836000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700219103.0000029833835000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi;	soft 1.14.exe, 00000001.00000003.1698661565.00000298335E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	soft 1.14.exe, 00000001.00000003.1700540417.0000029833836000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700219103.0000029833835000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	soft 1.14.exe, 00000001.00000003.1704697813.0000029832C4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/c	soft 1.14.exe, 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833855000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833819000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1701445096.0000029830D2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	soft 1.14.exe, 00000001.00000003.1706893890.0000029833F8D000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CC7000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833834000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.0000029833946000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C48000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832CBF000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1708846670.000002983393E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.000002983383C000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1704697813.0000029832C40000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	soft 1.14.exe, 00000001.00000003.1700932396.000002983383D000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833855000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700932396.0000029833819000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1701445096.0000029830D2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi	soft 1.14.exe, 00000001.00000003.1849179322.00000298335F0000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1849212145.00000298335F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	soft 1.14.exe, 00000001.00000003.1700540417.000002983384E000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1700681932.0000029830D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	soft 1.14.exe, 00000001.00000003.1710469569.000002983387A000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710469569.000002983389F000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1709033939.0000029833879000.00000004.00000020.00020000.00000000.sdmp, soft 1.14.exe, 00000001.00000003.1710598945.0000029830D2E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
147.45.44.216	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581513
Start date and time:	2024-12-27 23:39:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	soft 1.14.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 86 Number of non-executed functions: 133
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: soft 1.14.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	markiz.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	utkin.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	104.26.12.205
	Ref#20203216.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	tg.exe	Get hash	malicious	Babadeda	Browse	172.67.74.152
	tg.exe	Get hash	malicious	Babadeda	Browse	104.26.12.205
	setup.exe	Get hash	malicious	Babadeda	Browse	104.26.13.205
	QUOTATION#008792.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	c9toH15OT0.exe	Get hash	malicious	Unknown	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse	172.67.216.74
	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	104.21.92.91
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.30.13
	Installer.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse	104.18.11.207
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	104.21.73.97
	NewSetup.exe	Get hash	malicious	LummaC	Browse	172.67.157.249
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
FREE-NET-ASFREEnetEU	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131
	search.hta	Get hash	malicious	Unknown	Browse	147.45.112.248
	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Get hash	malicious	RedLine	Browse	147.45.44.224
	TCKxnQ5CPn.exe	Get hash	malicious	Unknown	Browse	147.45.49.155
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	147.45.44.151
	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	7ZAg3nl9Fu.exe	Get hash	malicious	Unknown	Browse	147.45.44.166
	HOrW5twCLd.exe	Get hash	malicious	XenoRAT	Browse	147.45.69.75
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	147.45.44.224

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	solara-executor.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Setup.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Setup.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	setup.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	search.hta	Get hash	malicious	Unknown	Browse	104.26.13.205
	TrdIE26br9.msi	Get hash	malicious	Unknown	Browse	104.26.13.205
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	104.26.13.205
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.13.205
	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	gshv2.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

Dropped Files

⊘No context

Created / dropped Files

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.84674468132717
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrU4wUsW3CNcwAFeMmvVOIHJFxMVlmJHaVFrIW1IrIW83Wy:P+pTpcU4nsTDAFSkIrxMVlmJHaVtr1eq
MD5:	38A6ED2824540859D2923148B0B1E0E1
SHA1:	3F99ADE9E9E545F56766083B437D956C4557D3A2
SHA-256:	CCB4CA9180D0A3BA685602EC69270BAD1C98D87C8D6D949AC4BE95FF719DA7B7
SHA-512:	C8B8BB9366862459513610A3E4EABA0DF37E1390ED47AAF92BBCB1375C92AFCA0E8A16423F953B53B25F4A533AFE569E0ACA77D2F57777D3BCAC44D15C70A7E7
Malicious:	false
Reputation:	low
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=136ms TTL=55....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 136ms, Maximum = 136ms, Average = 136ms..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	4.438053665347634
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	soft 1.14.exe
File size:	3'276'800 bytes
MD5:	9d28b3f2746f719fe82a21428f9265ae
SHA1:	3acd169f55124db5b2d46a95ffdd48d5a57e3c11
SHA256:	2b1545089a5a1be6fe2ce0fa399d982b4b7995a750a1ea0528695c7eed5f24d4
SHA512:	38c856ab59f7471c9b582c520a6d8b8cc47841c042802797055f8794439ece9c671c0c4922cfcb180af6fe7b4fc9bded48c936b910bc6482acf07ae9434ffb83
SSDEEP:	24576:qiiuUWnfyNSRhmCW5YeLuB7LAFFG3tXEZ83yCfv4vj3gvsceB9rGUoI65zkbu8w8:U+fce/frCAsLrZ+zH8S
TLSH:	4BE523017EA066F4C2394234ED674B1A7FA77E650304DBEB03A0524A1F627D59E3EB39
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....lg.........."...........0......P.........@.............................p2...........`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400050b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676C189D [Wed Dec 25 14:37:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	25224432afaf13c692f24efcb620c38b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FF35CF8C9C0h
dec eax
add esp, 28h
jmp 00007FF35CF8C5EFh
int3
int3
dec eax
sub esp, 28h
call 00007FF35CF8C784h
dec eax
neg eax
sbb eax, eax
neg eax
dec eax
dec eax
add esp, 28h
ret
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
cmp dword ptr [00318ABEh], FFFFFFFFh
dec eax
mov ebx, ecx
jne 00007FF35CF8C779h
call 00007FF35CF8E679h
jmp 00007FF35CF8C781h
dec eax
mov edx, ebx
dec eax
lea ecx, dword ptr [00318AA8h]
call 00007FF35CF8E5DCh
xor edx, edx
test eax, eax
dec eax
cmove edx, ebx
dec eax
mov eax, edx
dec eax
add esp, 20h
pop ebx
ret
int3
int3
dec eax
sub esp, 18h
dec esp
mov eax, ecx
mov eax, 00005A4Dh
cmp word ptr [FFFFAED5h], ax
jne 00007FF35CF8C7EAh
dec eax
arpl word ptr [FFFFAF08h], cx
dec eax
lea edx, dword ptr [FFFFAEC5h]
dec eax
add ecx, edx
cmp dword ptr [ecx], 00004550h
jne 00007FF35CF8C7D1h
mov eax, 0000020Bh
cmp word ptr [ecx+18h], ax
jne 00007FF35CF8C7C6h
dec esp
sub eax, edx
movzx edx, word ptr [ecx+14h]
dec eax
add edx, 18h
dec eax
add edx, ecx
movzx eax, word ptr [ecx+06h]
dec eax
lea ecx, dword ptr [eax+eax*4]
dec esp
lea ecx, dword ptr [edx+ecx*8]
dec eax
mov dword ptr [esp], edx
dec ecx
cmp edx, ecx
je 00007FF35CF8C78Ah
mov ecx, dword ptr [edx+0Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31ad90	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x325000	0x1a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x31f000	0x15a8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x326000	0x680	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x13040	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31b038	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11c80	0x11e00	0d92c650fbbfcda227074d695da6f26f	False	0.5210063374125874	data	6.374503128582078	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x309b1c	0x309c00	7d17df367edea335777be20f593d4c81	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31d000	0x1e70	0xc00	b04cb412c442d91003948daef4dbac9b	False	0.15234375	DOS executable (block device driver)	2.184963466978745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x31f000	0x15a8	0x1600	56e480cd444c6dbe71d072aaf68fc92d	False	0.46732954545454547	data	4.964764994621124	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x321000	0x38	0x200	5d344f072ffe90545ae42e007d19a6b2	False	0.072265625	data	0.4473268792999391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x322000	0xf60	0x1000	935a6a7d4fef213de176a26de65d5b15	False	0.418212890625	PGP symmetric key encrypted data - Plaintext or unencrypted data	4.923789045505213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x323000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
_RDATA	0x324000	0x1f4	0x200	e263646b1cb66aae2718bfe9d251bd12	False	0.5234375	data	3.7577827584492653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x325000	0x1a8	0x200	fc0936b2f8c7ff2ad90016c364cae0a2	False	0.482421875	data	4.178189311747683	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x326000	0x680	0x800	210679776348707cee9b93231a7eb5cc	False	0.51171875	data	4.9546245438601	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x325060	0x143	XML 1.0 document, ASCII text	English	United States	0.628482972136223

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CreateFileW, CreateProcessA, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileType, GetLastError, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetThreadContext, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadProcessMemory, ResumeThread, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwindEx, RtlVirtualUnwind, SetFilePointerEx, SetLastError, SetStdHandle, SetThreadContext, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualAllocEx, WideCharToMultiByte, WriteConsoleW, WriteFile, WriteProcessMemory

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T23:40:02.512809+0100	2046303	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M1	1	192.168.2.4	49730	147.45.44.216	15666	TCP
2024-12-27T23:40:02.512809+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	147.45.44.216	15666	TCP
2024-12-27T23:40:02.632795+0100	2046303	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M1	1	192.168.2.4	49730	147.45.44.216	15666	TCP
2024-12-27T23:40:02.632795+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	147.45.44.216	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 23:39:57.361365080 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:39:57.482841015 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:39:57.483192921 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:39:57.695359945 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:57.695421934 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:57.695549965 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:57.706051111 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:57.706073999 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:59.013942957 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:59.014035940 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:59.276457071 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:59.276474953 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:59.276822090 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:59.276891947 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:59.277995110 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:59.323331118 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:59.622783899 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:59.622843027 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:59.622852087 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:39:59.622901917 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:59.623207092 CET	49731	443	192.168.2.4	104.26.13.205
Dec 27, 2024 23:39:59.623226881 CET	443	49731	104.26.13.205	192.168.2.4
Dec 27, 2024 23:40:02.512809038 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.632673025 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632690907 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632699966 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632713079 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632721901 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632730007 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632740021 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632795095 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.632847071 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.632867098 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632875919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632884979 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.632930040 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.632942915 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752331972 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752438068 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752448082 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752475023 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752484083 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752520084 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752537966 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752571106 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752584934 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752603054 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752649069 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752657890 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752780914 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752825975 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752861977 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752880096 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752881050 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.752949953 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.752985954 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.753040075 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.753046989 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.753089905 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.872237921 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.872250080 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.872291088 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.872342110 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.872369051 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.872488976 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.872497082 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.872581005 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.872678995 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.872760057 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.872823954 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873065948 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873075008 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873080969 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873131990 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873138905 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873140097 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873197079 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873218060 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873226881 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873267889 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873272896 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873290062 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873311996 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873339891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873378992 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873389006 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873430967 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873435974 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873440027 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873466969 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873486042 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873506069 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873519897 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873569012 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.873581886 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873713970 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.873763084 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992028952 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992039919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992106915 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992115974 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992135048 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992165089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992185116 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992191076 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992219925 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992249966 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992253065 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992260933 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992311954 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992337942 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992347002 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992367029 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992376089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992393017 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992410898 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992429972 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992435932 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992444038 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992492914 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992568016 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992577076 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992607117 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992615938 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992633104 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992646933 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992655039 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992664099 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992703915 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992711067 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992712975 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992762089 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992830038 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992846012 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992887974 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.992922068 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992929935 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992934942 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992985964 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.992991924 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993037939 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993077993 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993086100 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993141890 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993161917 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993170023 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993189096 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993196964 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993223906 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993240118 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993328094 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993340969 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993385077 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993390083 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993392944 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993448973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993495941 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993510962 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993554115 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993560076 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993613005 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993616104 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993681908 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993686914 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993690968 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993736029 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993767977 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993776083 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993818045 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993819952 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993829966 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993874073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.993920088 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993928909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993935108 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993972063 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993978977 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.993992090 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994019032 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994050980 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994102001 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994118929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994127035 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994134903 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994193077 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994208097 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994216919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994261026 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994273901 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994283915 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994326115 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994348049 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994358063 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994404078 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994446039 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994503021 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994519949 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994569063 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994585037 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994615078 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:02.994618893 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:02.994663000 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.111498117 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111510038 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111577034 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.111702919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111711025 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111763000 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.111901999 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111910105 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111946106 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111959934 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.111967087 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.111989021 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112003088 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112029076 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112072945 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112076044 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112123013 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112224102 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112268925 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112287045 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112324953 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112353086 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112360954 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112406969 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112443924 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112451077 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112489939 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112603903 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112617970 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112624884 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112646103 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112667084 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112703085 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112751961 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112771988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112780094 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112823009 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112871885 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112879992 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112910986 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.112929106 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112951040 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.112982035 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113018036 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113066912 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113076925 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113123894 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113169909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113177061 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113224030 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113245964 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113254070 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113287926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113300085 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113332987 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113482952 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113491058 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113532066 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113570929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113579988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113616943 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113684893 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113692045 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113734961 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113847017 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113854885 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113893986 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.113907099 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113914967 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.113950014 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114002943 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114011049 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114046097 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114058018 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114065886 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114101887 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114116907 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114125013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114161968 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114229918 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114242077 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114272118 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114284992 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114288092 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114295959 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114329100 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114339113 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114378929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114387035 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114414930 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114425898 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114449978 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114492893 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114536047 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114545107 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114562035 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114574909 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114594936 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114619970 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114628077 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114662886 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114707947 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114717960 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114748001 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114758015 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114814043 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114849091 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114866972 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114875078 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114881992 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114914894 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.114968061 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.114975929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115001917 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115014076 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115077972 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115086079 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115120888 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115178108 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115185976 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115194082 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115214109 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115237951 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115284920 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115293980 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115303993 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115335941 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115475893 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115484953 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115494967 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115503073 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115510941 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115518093 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115526915 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115535021 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115559101 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115578890 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115629911 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115638018 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115645885 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115653038 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115675926 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115688086 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115856886 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115864992 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115871906 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115880966 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115888119 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115891933 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115891933 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115895033 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115902901 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115906954 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115911007 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115916967 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115936995 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115967989 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.115971088 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115992069 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.115999937 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116027117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116038084 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116055965 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116056919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116065025 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116105080 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116105080 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116115093 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116159916 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116173029 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116182089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116209984 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116225004 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116230965 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116245031 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116271019 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116281986 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116297007 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116307974 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116337061 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116352081 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116409063 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116416931 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116425037 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116452932 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116466045 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116511106 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116518974 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116527081 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116569996 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116590977 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116599083 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116605997 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116636038 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116656065 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116660118 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116698980 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116707087 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116714954 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116753101 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116760015 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116760969 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116791010 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116803885 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116810083 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116843939 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116867065 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116868019 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116874933 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116908073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116933107 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116940975 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.116970062 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.116981030 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.117024899 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.117033958 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.117039919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.117069006 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.117083073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.117094040 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.117101908 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.117233992 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.232136965 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.232148886 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.232156992 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.232160091 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.232383013 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.233170986 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.233179092 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.233215094 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.233222961 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.233346939 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.234373093 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234383106 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234409094 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234412909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234483004 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234493971 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234498978 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.234530926 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.234544992 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.234622955 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234633923 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234642982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.234692097 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.235594988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.235605001 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.235646963 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.235672951 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.235682011 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.235704899 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.235713959 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.235723972 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.235742092 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.235770941 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.236114025 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.236172915 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.236784935 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.236794949 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.236828089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.236836910 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.236840010 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.236871004 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.236881018 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.236891031 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.236917973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.236939907 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237073898 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237083912 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237138033 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237185001 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237207890 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237216949 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237235069 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237252951 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237421036 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237430096 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237478971 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237601042 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237610102 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237658024 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237759113 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237767935 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237808943 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237817049 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237818956 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237868071 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.237950087 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.237977982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238002062 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238023043 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238034010 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238044024 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238090992 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238102913 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238151073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238157988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238215923 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238219976 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238266945 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238270044 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238289118 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238296986 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238317966 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238334894 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238416910 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238466978 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238466978 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238476038 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238486052 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238516092 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238535881 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238591909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238605022 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238660097 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238661051 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238672018 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238723040 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238754988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238765001 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238817930 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238831043 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238886118 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238887072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238940001 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.238970041 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.238979101 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239037037 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239068985 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239078999 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239126921 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239154100 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239206076 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239231110 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239248037 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239259005 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239283085 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239300966 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239358902 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239368916 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239420891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239448071 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239497900 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239510059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239548922 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239561081 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239588022 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239590883 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239634991 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239643097 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239653111 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239707947 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239741087 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239749908 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239792109 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239799976 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239800930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239846945 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239892006 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239901066 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.239948034 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.239976883 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240022898 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240025997 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240036011 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240086079 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240094900 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240154982 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240161896 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240187883 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240212917 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240228891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240250111 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240258932 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240304947 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240346909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240355968 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240403891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240423918 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240433931 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240478039 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240534067 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240542889 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240588903 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240593910 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240639925 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240701914 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240736961 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240747929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240751982 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240781069 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240791082 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240798950 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240838051 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.240895033 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240905046 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.240959883 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241039991 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241086006 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241115093 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241169930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241175890 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241180897 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241230011 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241266012 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241275072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241322041 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241322994 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241332054 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241384983 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241410017 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241420031 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241478920 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241559029 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241569042 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241571903 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241605997 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241637945 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241657972 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241708040 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241718054 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241776943 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241836071 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241846085 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241893053 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.241969109 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.241976976 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242023945 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242033958 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242034912 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242084026 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242165089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242175102 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242182016 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242228985 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242228985 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242275000 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242297888 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242307901 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242355108 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242455006 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242465973 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242472887 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242482901 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242515087 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242535114 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242575884 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242585897 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242594004 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242602110 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242641926 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242749929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242759943 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242767096 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242775917 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242789984 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242824078 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242841959 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242852926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242861032 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242904902 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.242980003 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.242990971 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243036032 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243074894 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243086100 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243133068 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243160009 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243170023 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243220091 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243267059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243287086 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243338108 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243346930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243355989 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243400097 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243561029 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243570089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243613958 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243647099 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243655920 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243700981 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243705988 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243710995 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243761063 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243792057 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243822098 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243845940 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243860960 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.243928909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243937969 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243978977 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243988037 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.243995905 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244028091 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244038105 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244043112 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244074106 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244087934 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244115114 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244122982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244168997 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244173050 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244182110 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244231939 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244256973 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244265079 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244307995 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244318962 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244326115 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244333982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244384050 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244385004 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244422913 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244430065 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244471073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244488955 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244501114 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244508982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244549990 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244556904 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244582891 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244600058 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244633913 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244676113 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244705915 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244729042 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244740009 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244752884 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244757891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244782925 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244801044 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244822979 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244832039 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244877100 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.244900942 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244910002 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.244960070 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245023966 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245033026 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245048046 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245055914 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245088100 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245110989 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245119095 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245151043 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245160103 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245167017 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245199919 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245227098 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245235920 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245290041 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245318890 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245327950 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245359898 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245373011 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245409966 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245415926 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245457888 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245491028 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245500088 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245547056 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245548010 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245558023 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245565891 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245592117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245599031 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245611906 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245644093 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245646954 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245652914 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245697975 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245698929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245742083 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245748043 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.245749950 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.245804071 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.284663916 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.284888983 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.285003901 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.352400064 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352415085 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352430105 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352438927 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352454901 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352463961 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352502108 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352510929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352514029 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.352560043 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.352946043 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352956057 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352968931 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.352977037 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.353002071 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.353009939 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.353014946 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.353018999 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.353055954 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.353322983 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.353368044 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.353924036 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.353981972 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.354024887 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.354074955 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.354094982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.354141951 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.354146004 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.354197025 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.354227066 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.354234934 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.354281902 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.354314089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.354322910 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.354370117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.355041981 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355051041 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355101109 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.355194092 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355201960 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355251074 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.355293989 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355304003 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355345964 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.355468988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355478048 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355485916 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355494976 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355503082 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.355521917 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.355537891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356081009 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356089115 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356131077 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356287956 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356296062 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356333971 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356401920 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356410027 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356452942 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356456041 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356462002 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356503963 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356534958 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356543064 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356579065 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356590033 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356616020 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356635094 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356652975 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356652975 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356662989 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356703043 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356756926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356766939 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356812954 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356914997 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356924057 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356931925 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356946945 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356956005 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356962919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.356964111 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.356977940 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357007980 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357042074 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357050896 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357091904 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357094049 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357101917 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357136011 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357223034 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357234001 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357240915 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357265949 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357273102 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357285023 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357305050 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357362032 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357371092 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357402086 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357412100 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357412100 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357451916 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357465982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357474089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357517004 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357588053 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357595921 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357609987 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357618093 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357635975 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357662916 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357743025 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357752085 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357791901 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357806921 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357851028 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.357985020 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.357992887 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358001947 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358009100 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358016968 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358033895 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358047009 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358068943 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358092070 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358100891 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358127117 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358135939 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358139992 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358165979 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358182907 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358191967 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358227968 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358264923 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358273029 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358314991 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358355999 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358366013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358409882 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358438969 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358447075 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358488083 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358563900 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358575106 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358597040 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358607054 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358613968 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358616114 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358624935 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358628988 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358666897 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358681917 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358692884 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358735085 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358741045 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358751059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358789921 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358815908 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358825922 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358865976 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.358905077 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358913898 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358990908 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.358990908 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359002113 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359036922 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359045982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359083891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359157085 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359164953 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359174013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359203100 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359214067 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359277010 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359286070 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359293938 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359328032 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359338999 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359348059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359358072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359380007 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359396935 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359430075 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359440088 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359478951 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359481096 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359519005 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359559059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359570026 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359596014 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359611034 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359627962 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359637976 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359672070 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359725952 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359735966 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359744072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359760046 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359770060 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359781981 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359806061 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359807014 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359844923 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359863043 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359872103 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359910011 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.359952927 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359961987 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.359998941 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360004902 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360014915 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360050917 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360096931 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360105991 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360141993 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360183001 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360193968 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360220909 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360239029 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360241890 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360251904 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360285997 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360321045 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360330105 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360338926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360364914 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360377073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360433102 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360441923 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360450983 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360460043 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360471010 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360479116 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360496998 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360512972 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360537052 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360546112 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360554934 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360563993 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360580921 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360598087 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360610008 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360619068 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360646963 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360661030 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360707045 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360716105 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360754967 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360763073 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360809088 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360816002 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360826015 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360836029 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360853910 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360873938 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360874891 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360884905 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360913992 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360928059 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360933065 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.360970974 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.360990047 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361000061 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361043930 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361054897 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361064911 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361093998 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361112118 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361114025 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361131907 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361150026 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361164093 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361180067 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361218929 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361224890 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361258030 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361260891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361298084 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361316919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361327887 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361354113 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361358881 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361366987 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361367941 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361388922 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361402988 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361460924 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361470938 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361489058 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361498117 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361498117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361507893 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361529112 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361648083 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361658096 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361665964 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361674070 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361697912 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361713886 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361814022 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361823082 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361833096 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361843109 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361851931 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361860991 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361861944 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361871004 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361875057 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361895084 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361905098 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361906052 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361915112 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361922026 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361947060 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361948013 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361957073 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.361959934 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.361990929 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362061024 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362070084 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362077951 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362088919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362111092 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362140894 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362166882 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362175941 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362209082 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362237930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362246990 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362273932 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362282038 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362282991 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362329006 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362411022 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362420082 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362428904 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362437963 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362454891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362468004 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362487078 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362487078 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362497091 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362531900 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362565994 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362603903 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362664938 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362673998 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362682104 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362714052 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362715006 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362724066 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362761974 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362783909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362792969 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362828016 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362901926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362910986 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362943888 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362946033 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.362953901 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.362992048 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363050938 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363059998 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363094091 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363101959 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363111019 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363146067 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363244057 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363257885 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363266945 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363281012 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363291979 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363306999 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363363028 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363372087 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363380909 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363404036 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363420010 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363434076 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363444090 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363456011 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363481045 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363491058 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363493919 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363513947 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363533020 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363548040 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363554955 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363564014 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363595009 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363603115 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363615036 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363651037 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363673925 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363682985 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363708019 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363723993 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363754034 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363763094 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363794088 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363830090 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363838911 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363864899 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363878012 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363914013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363924026 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363954067 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.363962889 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.363964081 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364000082 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364042997 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364053011 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364062071 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364080906 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364092112 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364093065 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364104033 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364131927 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364144087 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364207029 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364216089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364227057 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364248037 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364254951 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364259005 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364263058 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364300013 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364317894 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364343882 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364352942 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364381075 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364392996 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364414930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364423990 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364448071 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364461899 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364480019 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364518881 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364542961 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364552021 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364561081 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364578962 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364593983 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364624023 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364633083 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364664078 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364679098 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364687920 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364715099 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364729881 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364742041 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364751101 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364779949 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364795923 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364809036 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364819050 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364845037 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364854097 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364857912 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364864111 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364890099 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364902020 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.364911079 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.364944935 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365004063 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365012884 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365022898 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365037918 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365061045 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365134001 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365142107 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365150928 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365159988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365169048 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365169048 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365191936 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365215063 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365262032 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365269899 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365277052 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365286112 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365294933 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365303993 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365324020 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365339994 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365371943 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365381002 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365389109 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365397930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365408897 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365412951 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365421057 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365427971 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365447998 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365457058 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365464926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365467072 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365499973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365536928 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365545034 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365576982 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365607023 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365616083 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365642071 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365663052 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365705967 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365715027 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365748882 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365752935 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365761042 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365780115 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365789890 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365803003 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365824938 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365844965 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365880013 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.365964890 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365972996 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365982056 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365989923 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.365998030 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366000891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366028070 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366043091 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366079092 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366090059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366097927 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366106033 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366118908 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366132021 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366153002 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366255999 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366265059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366274118 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366281986 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366291046 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366292953 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366300106 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366307020 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366307020 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366324902 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366331100 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366333008 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366353989 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366358995 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366367102 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366379976 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366411924 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366447926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366456985 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366482973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366493940 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366506100 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366513968 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366543055 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366553068 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366570950 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366579056 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366607904 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366624117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366632938 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366642952 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366667032 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366678953 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366695881 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366704941 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366730928 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366744995 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366756916 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366767883 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366797924 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366812944 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366852045 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366861105 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366868973 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366878986 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366888046 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366906881 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366928101 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.366961002 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366969109 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366978884 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.366996050 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367010117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367090940 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367100000 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367108107 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367131948 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367146969 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367158890 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367167950 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367192984 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367208004 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367250919 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367259979 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367275000 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367284060 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367288113 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367301941 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367309093 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367326975 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367326975 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367342949 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367366076 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367433071 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367440939 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367449045 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367471933 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367495060 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367544889 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367553949 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367561102 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367571115 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367589951 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367609024 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367742062 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367749929 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367758036 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367765903 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367773056 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367779016 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367782116 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367782116 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367784977 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367789030 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367791891 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367842913 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367860079 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367867947 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367876053 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367883921 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367907047 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367923975 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367937088 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367945910 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367953062 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367961884 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367970943 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.367980957 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.367990971 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368007898 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368057013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368065119 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368072987 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368082047 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368091106 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368093014 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368115902 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368132114 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368251085 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368258953 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368268013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368275881 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368284941 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368284941 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368293047 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368304014 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368310928 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368313074 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368325949 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368341923 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368361950 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368416071 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368424892 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368433952 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368442059 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368449926 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368454933 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368465900 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368472099 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368474007 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368483067 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368488073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368490934 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368510962 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368534088 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368558884 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368597031 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368606091 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368613958 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368622065 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368630886 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368634939 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368655920 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368680954 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368777990 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368787050 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368794918 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368803024 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368812084 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368815899 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368820906 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368827105 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368829012 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368838072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368845940 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368849993 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368858099 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368865967 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368875027 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368884087 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368905067 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368913889 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.368954897 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368963957 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368971109 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368979931 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.368989944 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.369012117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.369126081 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369134903 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369142056 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369152069 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369159937 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369164944 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.369178057 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.369187117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.369199038 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.369379044 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369386911 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369395018 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.369427919 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.404814005 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.404828072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.404839039 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.404855013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.404898882 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.404907942 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.404912949 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.404936075 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.404946089 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.404978037 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405006886 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405070066 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405081034 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405087948 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405128002 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405137062 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405144930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405189037 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405234098 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405245066 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405287027 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405297041 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405308008 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405348063 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405455112 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405462980 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405469894 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405477047 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405510902 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405565023 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405572891 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405613899 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405647993 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405658960 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405704021 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405776978 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405786037 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405805111 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405853987 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405869961 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405914068 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.405920982 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405930042 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.405975103 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406002998 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406012058 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406056881 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406088114 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406096935 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406138897 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406164885 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406198025 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406213045 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406243086 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406266928 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406275988 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406327009 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406408072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406440973 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406452894 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406455040 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406464100 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406476974 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406512022 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.406563044 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406572104 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.406616926 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.471801996 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.471810102 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.471851110 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.471858025 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.471877098 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.471903086 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.471909046 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.471919060 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.471952915 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.471966028 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.471991062 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.471998930 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472044945 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472050905 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472068071 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472100973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472292900 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472333908 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472461939 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472475052 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472516060 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472527027 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472534895 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472554922 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472580910 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472598076 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472621918 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472630978 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472639084 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472672939 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472688913 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472697973 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472738981 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472739935 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472773075 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472783089 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472791910 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472800970 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472826958 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472846031 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472867012 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472876072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472915888 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.472939968 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472949028 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472982883 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472990990 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.472992897 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473016024 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473040104 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473079920 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473419905 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473464012 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473500013 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473509073 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473515987 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473558903 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473561049 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473570108 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473611116 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473622084 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473644018 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473679066 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473742008 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473768950 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473783970 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473808050 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473822117 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473829985 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473874092 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473875046 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473884106 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473920107 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473925114 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.473927975 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.473977089 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.474004984 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474013090 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474051952 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.474163055 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474172115 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474215031 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.474256039 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474263906 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474270105 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474277973 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474309921 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.474328995 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.474370956 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.474419117 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.501424074 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.501631975 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502474070 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502542973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502594948 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502662897 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502706051 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502775908 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502825975 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502887964 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502937078 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.502996922 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503052950 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503120899 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503170013 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503240108 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503297091 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503364086 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503422022 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503489017 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503546000 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503606081 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503659964 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503724098 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503773928 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503850937 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503865957 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.503899097 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.524486065 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.524568081 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.565751076 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.565969944 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.566056967 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.566092014 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.621731043 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.622083902 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.622201920 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.622262001 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.622323036 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.622348070 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645327091 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.645577908 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645675898 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645733118 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645802021 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645845890 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645900011 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645941973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.645993948 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646039009 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646100998 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646153927 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646215916 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646261930 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646316051 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646367073 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646434069 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646481991 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646538973 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646599054 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646661043 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646717072 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646795034 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.646842957 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.685903072 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.686254025 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.686327934 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.686369896 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.729739904 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.729892969 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.729969025 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.730010986 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.773705959 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.773910999 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.773989916 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774035931 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774102926 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774154902 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774230003 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.774235010 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774292946 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774362087 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774420023 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774432898 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.774444103 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.774493933 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.774494886 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774503946 CET	15666	49730	147.45.44.216	192.168.2.4
Dec 27, 2024 23:40:03.774538040 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774593115 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774637938 CET	49730	15666	192.168.2.4	147.45.44.216
Dec 27, 2024 23:40:03.774655104 CET	15666	49730	147.45.44.216	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 23:39:57.549932003 CET	192.168.2.4	1.1.1.1	0xade3	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 23:39:57.687634945 CET	1.1.1.1	192.168.2.4	0xade3	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:39:57.687634945 CET	1.1.1.1	192.168.2.4	0xade3	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 27, 2024 23:39:57.687634945 CET	1.1.1.1	192.168.2.4	0xade3	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.26.13.205	443	7544	C:\Users\user\Desktop\soft 1.14.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 22:39:59 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-12-27 22:39:59 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 22:39:59 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8f8ccf4c8db49e02-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2009&min_rtt=2006&rtt_var=759&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=1436301&cwnd=244&unsent_bytes=0&cid=b316d018d6a7268a&ts=618&x=0"
2024-12-27 22:39:59 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	17:39:55
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\soft 1.14.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\soft 1.14.exe"
Imagebase:	0x7ff608070000
File size:	3'276'800 bytes
MD5 hash:	9D28B3F2746F719FE82A21428F9265AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:39:56
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\soft 1.14.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\soft 1.14.exe"
Imagebase:	0x7ff608070000
File size:	3'276'800 bytes
MD5 hash:	9D28B3F2746F719FE82A21428F9265AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000001.00000002.1850037500.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000001.00000003.1849372179.0000029830CA4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:40:13
Start date:	27/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\soft 1.14.exe"
Imagebase:	0x7ff7663d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:40:13
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:40:13
Start date:	27/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 1.1.1.1 -n 1 -w 3000
Imagebase:	0x7ff646420000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	1344
Total number of Limit Nodes:	24

Executed Functions

Function 00007FF608079B9C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF608079B6C,?,?,00000000,00007FF60807BCDB,?,?,00000003,00007FF608076809), ref: 00007FF608079D18
GetProcAddress.KERNEL32(?,?,?,00007FF608079B6C,?,?,00000000,00007FF60807BCDB,?,?,00000003,00007FF608076809), ref: 00007FF608079D24

Strings

MZx, xrefs: 00007FF608079BBB, 00007FF608079CA1, 00007FF608079D01
ext-ms-, xrefs: 00007FF608079C75
api-ms-, xrefs: 00007FF608079C62

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: 22012f02682711b3799a961ab12125ad5bd7006ea3965d99f2077911abd80764
Instruction ID: 6fd1967041e5f9ac08e2058ea3befd94d2f68fe26977aff1880d968d81d546cd
Opcode Fuzzy Hash: 22012f02682711b3799a961ab12125ad5bd7006ea3965d99f2077911abd80764
Instruction Fuzzy Hash: EE41DE22F19A0281FB1ACB36981467527D6BF88BA0F294535DD0ECB7C5EE3CE445830C

Function 00007FF608074340 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF608074399

Part of subcall function 00007FF608074630: CreateProcessA.KERNELBASE ref: 00007FF60807469E

Strings

@, xrefs: 00007FF6080744C7
U, xrefs: 00007FF60807441F
h, xrefs: 00007FF6080743DA

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CreateFileModuleNameProcess
String ID: @$U$h
API String ID: 2157755880-1769436074
Opcode ID: ac2049599329be2e5e576ae922c25a86fa67dca48e68f9b77c98ef5ba77e9d5b
Instruction ID: 73dede853b80022d941c14f30a05cf942b3246729e164447ce475acf2b1ecb3c
Opcode Fuzzy Hash: ac2049599329be2e5e576ae922c25a86fa67dca48e68f9b77c98ef5ba77e9d5b
Instruction Fuzzy Hash: 79711F76A08BC5C1DA60CB55F4503AEB760FBC9B94F504026EA8E87BA9DF7CD045CB08

Function 00007FF608074F3C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF608075210: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF608075224

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF608074F60
__scrt_release_startup_lock.LIBCMT ref: 00007FF608074FCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF608075021

Strings

MZx, xrefs: 00007FF608075036

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID: MZx
API String ID: 3251591375-2575928145
Opcode ID: fc8042bb87e420838d7706c2e1d2f26ac8af05287a7a71abb2327b768e75cc79
Instruction ID: 4852bfc57493b9c88f5f52196063ede76c6124c191b5d30b4d06b300dbf818c5
Opcode Fuzzy Hash: fc8042bb87e420838d7706c2e1d2f26ac8af05287a7a71abb2327b768e75cc79
Instruction Fuzzy Hash: 93315D31E0C64786FA24EB7498623F92291AF81385F785435EA0FCB2D3DE6DB404C29D

Function 00007FF6080799F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(00000001,00007FF60807AB53), ref: 00007FF608079A95
LCMapStringW.KERNEL32(00000001,00007FF60807AB53), ref: 00007FF608079AC9

Strings

LCMapStringEx, xrefs: 00007FF608079A25

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: f9633275d9ee9d3b20b8a7fa8d609a387c4e2dab78c2b7ebc5d766684dffdc6a
Instruction ID: e17b43c67dfeba3dc1d9c9903a3a997c5c73d93936d87dea0d6394c113bdd202
Opcode Fuzzy Hash: f9633275d9ee9d3b20b8a7fa8d609a387c4e2dab78c2b7ebc5d766684dffdc6a
Instruction Fuzzy Hash: 96212C35A08B8186DB64CB66F44029AB7A4FBC8BD0F544136EACD83B59DF3CD5408B48

Function 00007FF608076824 Relevance: 4.5, APIs: 3, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00000003,00007FF60807691C), ref: 00007FF608076835
TerminateProcess.KERNEL32(?,?,00000003,00007FF60807691C), ref: 00007FF608076840
ExitProcess.KERNEL32 ref: 00007FF60807684F

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d1b5e31b8130739252ba024cd7ee30c115cd396cc8feb26cc4374d0b0c240fe4
Instruction ID: 22183113ec345f411b6ec89994c3033fd47471348cc6f5ac6a6c8ec0bfd9796e
Opcode Fuzzy Hash: d1b5e31b8130739252ba024cd7ee30c115cd396cc8feb26cc4374d0b0c240fe4
Instruction Fuzzy Hash: 6FD05E50F08B0382FA48AFB0188507842511F98721F341838C82FD63E3EE6DA44C820C

Function 00007FF60807AFC8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32 ref: 00007FF60807B00A

Strings

, xrefs: 00007FF60807B04D

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 741c4182e17423b6762c14ee47741467d08430751a7f72457cdc24d02ab79553
Instruction ID: 3a9a51557edccb6b0bc99d5333e0254e0eae564dc57aed43f41978b54cc2c99a
Opcode Fuzzy Hash: 741c4182e17423b6762c14ee47741467d08430751a7f72457cdc24d02ab79553
Instruction Fuzzy Hash: F7517C72A182C18AE721CF34E0947AE7BA0F749754FA4413AD78E83A86CF7CD555CB48

Function 00007FF60807A8C8 Relevance: 3.2, APIs: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60807AB88: GetOEMCP.KERNEL32 ref: 00007FF60807ABB2

IsValidCodePage.KERNEL32 ref: 00007FF60807A935
GetCPInfo.KERNEL32 ref: 00007FF60807A979

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 2dc6afea859580e6037be6593a21ed62edb713420741d641145777749c96bdf2
Instruction ID: 22ba650b51578bd1e1dd5ce3aa9ff80ae5bbd1b0b24cfb3d8b50402ad1480f13
Opcode Fuzzy Hash: 2dc6afea859580e6037be6593a21ed62edb713420741d641145777749c96bdf2
Instruction Fuzzy Hash: 3381AB62F086A2A6FB64CF39A05417DB6A2EB44780F694036C68F876D1DF7DE941C30C

Function 00007FF608074E38 Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6080759E0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF608074E57), ref: 00007FF608075A30
Part of subcall function 00007FF6080759E0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF608074E57), ref: 00007FF608075A71

_set_fmode.LIBCMT ref: 00007FF608074E6F
_RTC_Initialize.LIBCMT ref: 00007FF608074E90

Part of subcall function 00007FF608076BBC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF608076BEE

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ExceptionFileHeaderInitializeRaise_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 2451193124-0
Opcode ID: f3c0430470f07399e506a1be3701e989bbb1d8738ebd37febbeea140212f0efb
Instruction ID: d12c9f389a1c1d48f87a5673c309d246f76bc5c55707d575eb65962ea00950eb
Opcode Fuzzy Hash: f3c0430470f07399e506a1be3701e989bbb1d8738ebd37febbeea140212f0efb
Instruction Fuzzy Hash: 1421E6A1E0D64386FA24F7B08D431FC11619FA4345FB00474E60FCA2E3DE9DB841866E

Function 00007FF60807B380 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF60807BF8A,?,?,?,00007FF60807BE8B,?,?,00000000,00007FF60807C9A9,?,?,?,00007FF60807C8B3), ref: 00007FF60807B396
GetLastError.KERNEL32(?,?,?,00007FF60807BF8A,?,?,?,00007FF60807BE8B,?,?,00000000,00007FF60807C9A9,?,?,?,00007FF60807C8B3), ref: 00007FF60807B3A0

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ee630889352ed936ae553ba63d3b4f6f14bc721ad53d24028daf506015ee0002
Instruction ID: 911bbac8a97a79ba5afc358512930cd0a63d6f19591853140610e0a1b66d43a4
Opcode Fuzzy Hash: ee630889352ed936ae553ba63d3b4f6f14bc721ad53d24028daf506015ee0002
Instruction Fuzzy Hash: 4AE0EC90F0970786FF18EBF258A607562519FC9B60F6C5434D90EC6292EE6C6895835C

Function 00007FF60807671C Relevance: 1.6, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF60807687F

Part of subcall function 00007FF608076790: GetModuleHandleExW.KERNEL32 ref: 00007FF6080767B5
Part of subcall function 00007FF608076790: GetProcAddress.KERNEL32 ref: 00007FF6080767CB
Part of subcall function 00007FF608076790: FreeLibrary.KERNEL32 ref: 00007FF6080767F2

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 883d2c84c99c049fafe14cfb7c78426d52a6edd162f08307a95ee2a3b685a9ec
Instruction ID: b638015034c6a768f57da8799cd79d3d23122679dd5c5e9650cb4f89906c1339
Opcode Fuzzy Hash: 883d2c84c99c049fafe14cfb7c78426d52a6edd162f08307a95ee2a3b685a9ec
Instruction Fuzzy Hash: 5D219172E04B418AFBA4CF74C4402AC37A0EB54318F244A35D62F86AC5EF39D548CB68

Function 00007FF60807D464 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60807D48F

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 01c91395c1916870b6ebb99eb882ff78e046b85d5793e410e623a649603b4a33
Instruction ID: 897910006a8d0e93605d773ac2f96f4ef01b17528585c44c1ce801c7817fec71
Opcode Fuzzy Hash: 01c91395c1916870b6ebb99eb882ff78e046b85d5793e410e623a649603b4a33
Instruction Fuzzy Hash: 2E112532E0869287F254EB24E44156977A5FF80740F690435EA9EC7BEADE7CF8108B4C

Function 00007FF608074630 Relevance: 1.5, APIs: 1, Instructions: 28
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF60807469E

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 55f193832a280cde99d3965d7a83e62b7f155f16e8e51956fffb024c732bc776
Instruction ID: 7b30cc0500f8453031a1840dc57498979298efb9088a73faa5a1a89e7d1f3412
Opcode Fuzzy Hash: 55f193832a280cde99d3965d7a83e62b7f155f16e8e51956fffb024c732bc776
Instruction Fuzzy Hash: A6F0BD76618B9482E310CB56F48070ABBA5F3C97A4F604519EBC887B28CBBDC1658F40

Function 00007FF6080726F0 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF608072733

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c26739b86664f408db0c9997770f65723e3fc929f09927d10a92c6213d1838f9
Instruction ID: 9e531c5ba1523301a4ec6bde64e3e8747c596ede5149d7da51e87e742eb4c5b0
Opcode Fuzzy Hash: c26739b86664f408db0c9997770f65723e3fc929f09927d10a92c6213d1838f9
Instruction Fuzzy Hash: 65F01222E1DB8581D660DB14F58122EA3A1FF847A4F201231F69F82BE9CE3CD491CB0C

Function 00007FF608074C44 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF608074C74

Part of subcall function 00007FF608074E18: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF608074E21

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 931c02c4fcd203e15d47adf75942f4b0e5fe0fb3ee4ad08f730a2a0a270399f2
Instruction ID: f9cf21dfd3a0a6328973303bc52e85c0aa3bc19c0801e8c6b47fec3738cfc508
Opcode Fuzzy Hash: 931c02c4fcd203e15d47adf75942f4b0e5fe0fb3ee4ad08f730a2a0a270399f2
Instruction Fuzzy Hash: 70E01701E5990B45FEA9F6B214260B901800F597B0E3D1B30D97FC92C3AD1DB8A5855C

Function 00007FF6080746F0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE ref: 00007FF608074749

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 590438e11f57b6ac7bad76fc945ab05e233fba6b9bcb9c07e7f5b99c2efd162e
Instruction ID: 0221021114ddaea0c4ffe1974c9edf93045fd49896d3c0adace5cb34323aaca5
Opcode Fuzzy Hash: 590438e11f57b6ac7bad76fc945ab05e233fba6b9bcb9c07e7f5b99c2efd162e
Instruction Fuzzy Hash: 5AF0FF36518B8482C6509B45F48170AB7B4F39A7A4F60511AFAC957B28CF7DC0648B00

Function 00007FF608074760 Relevance: 1.5, APIs: 1, Instructions: 20injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE ref: 00007FF6080747BB

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9ea2c8076de443cf59f910db1f613f80aa3e07039da84784684faed62c920b0f
Instruction ID: f45c64e63f28e37489c5d7ebad486cc9da1a63c2bc0b070a7a6489e9c0f778f5
Opcode Fuzzy Hash: 9ea2c8076de443cf59f910db1f613f80aa3e07039da84784684faed62c920b0f
Instruction Fuzzy Hash: 2BF0FA3A518B8881C6609B45F48074AB7B4F79ABA4F645116EACD83B28DF79C1648B00

Function 00007FF608075210 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF608075224

Part of subcall function 00007FF6080764CC: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF6080764D4
Part of subcall function 00007FF6080764CC: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF6080764D9

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: e9d6ae88fc6a71f53c5a11da52503330d916ee548e66a10f83e59118ebd616ce
Instruction ID: c91b126dd9251cf101dba1f425c48af5936c2e28713ab022f729cdd5ef71aab4
Opcode Fuzzy Hash: e9d6ae88fc6a71f53c5a11da52503330d916ee548e66a10f83e59118ebd616ce
Instruction Fuzzy Hash: 63E0BD35E0E68384FEA9FAB129022F902401F32344FB01078DA6FD22C39E0E244B162E

Function 00007FF60807C1C8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF60807A072,?,?,?,00007FF60807C125,?,?,?,?,00007FF608077D08), ref: 00007FF60807C21D

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 135306cfd6f981af923da4fe000d2c37e782639362960f7bd737ffabaa1f0f79
Instruction ID: e5ca26909aee0a3db7df4f34b05d2d3098b4c0129748c8e92acd24f64b81cef0
Opcode Fuzzy Hash: 135306cfd6f981af923da4fe000d2c37e782639362960f7bd737ffabaa1f0f79
Instruction Fuzzy Hash: D7F06D14F0930B85FE58D7F1A8212B553806F8AB90F7C5431CD0FC66D2EE5CE482821C

Function 00007FF60807C240 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF60807F389,?,?,00000000,00007FF60807D083,?,?,?,00007FF6080770BF,?,?,?,00007FF6080772FD), ref: 00007FF60807C27E

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 81c4a1072c291bc039217ef3688a7505bcb60df8785fb09408a2d79300e577ee
Instruction ID: 6344f88d4511c38950fe9293d06110f1b255e3da413d18827482c93bfeb26182
Opcode Fuzzy Hash: 81c4a1072c291bc039217ef3688a7505bcb60df8785fb09408a2d79300e577ee
Instruction Fuzzy Hash: 9DF01C50F0970B85FE64D7F259512B55380AF85BA0F3C4634DD2FC62C2DE6CA442461C

Non-executed Functions

Function 00007FF60807CA90 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60807CAE4
FindFirstFileExW.KERNEL32 ref: 00007FF60807CBEE

Strings

C:\Users\user\Desktop\soft 1.14.exe, xrefs: 00007FF60807CA9E

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\soft 1.14.exe
API String ID: 2227656907-904005308
Opcode ID: e225d3fb6d4ae7c10b93392ed77da4608c0e544a1bff775a08a37f312803c6a9
Instruction ID: 1167d7c972a780e74cb4fa6c4d3175891b350d6bccdd9d2e9f33a75d32bd01fc
Opcode Fuzzy Hash: e225d3fb6d4ae7c10b93392ed77da4608c0e544a1bff775a08a37f312803c6a9
Instruction Fuzzy Hash: 6CB1C122F1868681FA60DB35E4042B96390EB85BE4F644131EE5F9BBC9DF3CE941830C

Function 00007FF6080754D4 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6080754F0
RtlCaptureContext.KERNEL32 ref: 00007FF60807551D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF608075537
RtlVirtualUnwind.KERNEL32 ref: 00007FF608075578
IsDebuggerPresent.KERNEL32 ref: 00007FF6080755CC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6080755E9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6080755F4

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 5f043ce2f24c5dd1fc7556dc09ed2e4de8428533f533a7f6f2f8a904c65be6c1
Instruction ID: 38427a7c1a0420ddc728c653dc84aacbf0127b154fced3301eac4846174c2634
Opcode Fuzzy Hash: 5f043ce2f24c5dd1fc7556dc09ed2e4de8428533f533a7f6f2f8a904c65be6c1
Instruction Fuzzy Hash: CE313C72A08B8286EB64CF70E8403EE7360FB84754F54443ADA4E87B95DF78D548C718

Function 00007FF608077760 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6080777D9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6080777F1
RtlVirtualUnwind.KERNEL32 ref: 00007FF60807782C
IsDebuggerPresent.KERNEL32 ref: 00007FF608077865
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF60807786F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF60807787A

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 0682ff08e83aaada5c55492228567788b13ab54fda938eba02d557cdfddf4092
Instruction ID: f99f1d95540be6d023456db5bd76f61420b4e64eb7db584c11a696d88b4b2f8f
Opcode Fuzzy Hash: 0682ff08e83aaada5c55492228567788b13ab54fda938eba02d557cdfddf4092
Instruction Fuzzy Hash: A9318632A08F8186EB64CF75E8402AE73A0FB88794F640135EA9D87B95DF7CD545CB04

Function 00007FF608075304 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF608075330
GetCurrentThreadId.KERNEL32 ref: 00007FF60807533E
GetCurrentProcessId.KERNEL32 ref: 00007FF60807534A
QueryPerformanceCounter.KERNEL32 ref: 00007FF60807535A

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1ef9cfd6a28bfbf257edefedf7c8203de68038772214ee7f848650bd26ef0748
Instruction ID: aa8045bfd570cf42edd20c810431070e8ad32adfb0c7622d485ff57cfd20fb03
Opcode Fuzzy Hash: 1ef9cfd6a28bfbf257edefedf7c8203de68038772214ee7f848650bd26ef0748
Instruction Fuzzy Hash: 6A111C22B14B06CAEB00CBB0E8556A833A4F799768F580E31DA6DC77A4DFB8D1558344

Function 00007FF608079E10 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF608079E14

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 04e430f214420386c097ea80a3f65c29a15293500482715ba298f06b5bffda18
Instruction ID: 430b9f7fe041f4c4e464b55307b7c0d1a172e35144f91d0d9f09bf0e88032a15
Opcode Fuzzy Hash: 04e430f214420386c097ea80a3f65c29a15293500482715ba298f06b5bffda18
Instruction Fuzzy Hash: 17B09220E07B07C2EE4CABA16C8A21423A47F88B10FAC4038C00CC1320DEAC24A54704

Function 00007FF608072DD0 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2493b7593c7a72a3c048878eaa47db4bf64ef86c7613569d36cef1db600bd04e
Instruction ID: 8340270c88e46fceeaee4401535da6801ab4f347eca235a49d8bcb4074e4607a
Opcode Fuzzy Hash: 2493b7593c7a72a3c048878eaa47db4bf64ef86c7613569d36cef1db600bd04e
Instruction Fuzzy Hash: 2D4284BA6086048AD764CF19D09151ABBF0F7CCBA8B194216EF8E83765DF39D582CF44

Function 00007FF608077008 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: e5e308dfeada57223cb931c0b5dfaffe289988bed981820dc51f875181d83110
Instruction ID: 242aabd5b35068f1c422712ba27c5da9ee6a91c02e107665d40ff4177f900bca
Opcode Fuzzy Hash: e5e308dfeada57223cb931c0b5dfaffe289988bed981820dc51f875181d83110
Instruction Fuzzy Hash: DD41D672B14A5585EF08CF7AD9145697391BB88FD4B299032DE0ED7B98DF3CD1428308

Function 00007FF6080817D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e227a93ecbd0eaa87d54bff9a39891396378540c1ebb38e19a135996851a4b
Instruction ID: 1e14b3979a1de0a267a2a10ed5eb9d60c0fe4fc6fce33e9677e7f6f6750d887f
Opcode Fuzzy Hash: 36e227a93ecbd0eaa87d54bff9a39891396378540c1ebb38e19a135996851a4b
Instruction Fuzzy Hash: 48F01872B18755CBEB98CF79A84262977D0F748384F648039D58DC3B14DA7C9451CF18

Function 00007FF6080754C4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f9b99e833d81c9360031323baeb257995531fff9fb24a03fa220d7ef962a05
Instruction ID: 41e309b0d21e67041589f43ef3e3a9770ac4429950023669125d251b7eef9b65
Opcode Fuzzy Hash: f3f9b99e833d81c9360031323baeb257995531fff9fb24a03fa220d7ef962a05
Instruction Fuzzy Hash: 4CA00161918D0AD0E648CB60AC504796320AB90320BA44171C00EC20B09E6CA401820C

Function 00007FF608078F5C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF608078FB9

Part of subcall function 00007FF608078424: __GetUnwindTryBlock.LIBCMT ref: 00007FF608078467
Part of subcall function 00007FF608078424: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF60807848C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF608079091
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6080792DF
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6080793EC

Strings

csm, xrefs: 00007FF6080790B4
csm, xrefs: 00007FF608078FD3
csm, xrefs: 00007FF60807903A

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 3761cf37712abdcf1e6db3273805001c4b0028c3034cc92ba4d43b14fc4efdf9
Instruction ID: 0483e54aeef2c64c825c9004a58d5a2173fd8f2e2b30ed2dd8654dcbb403186f
Opcode Fuzzy Hash: 3761cf37712abdcf1e6db3273805001c4b0028c3034cc92ba4d43b14fc4efdf9
Instruction Fuzzy Hash: B5D17C72E08B418AEB60DB7594453AD7BA0FB55788F204235EA4E97BD6CF3CE091C748

Function 00007FF60807D75C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF60807D5F1,?,?,00000000,00007FF608078034), ref: 00007FF60807D7E1
GetLastError.KERNEL32(?,?,?,00007FF60807D5F1,?,?,00000000,00007FF608078034), ref: 00007FF60807D7EF
LoadLibraryExW.KERNEL32(?,?,?,00007FF60807D5F1,?,?,00000000,00007FF608078034), ref: 00007FF60807D819
FreeLibrary.KERNEL32(?,?,?,00007FF60807D5F1,?,?,00000000,00007FF608078034), ref: 00007FF60807D887
GetProcAddress.KERNEL32(?,?,?,00007FF60807D5F1,?,?,00000000,00007FF608078034), ref: 00007FF60807D893

Strings

MZx, xrefs: 00007FF60807D77A, 00007FF60807D82A, 00007FF60807D870
api-ms-, xrefs: 00007FF60807D801

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: MZx$api-ms-
API String ID: 2559590344-259127448
Opcode ID: e3e0607afb2d36fe791d2cb7d0cfe75f8ab5f5604bbfa85aa404c328e2221570
Instruction ID: ca621fca396683ac0bf48e700c8205065d8e3701cfb6f3f92027ede6ba597763
Opcode Fuzzy Hash: e3e0607afb2d36fe791d2cb7d0cfe75f8ab5f5604bbfa85aa404c328e2221570
Instruction Fuzzy Hash: F6319E21F1AB4281FE56DB62A8006756298BF48BB0F690535DD2E8A7D5EE7CE441830C

Function 00007FF608079E98 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF608079EA7
FlsGetValue.KERNEL32 ref: 00007FF608079EBC
FlsSetValue.KERNEL32 ref: 00007FF608079EDD
FlsSetValue.KERNEL32 ref: 00007FF608079F0A
FlsSetValue.KERNEL32 ref: 00007FF608079F1B
FlsSetValue.KERNEL32 ref: 00007FF608079F2C
SetLastError.KERNEL32 ref: 00007FF608079F47

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 8eb7e9acec1751e613be6750b9c04c95c48d5d700aaadb3b6e51bf6b1cebdfde
Instruction ID: 38a82036e5573a5e5493af1353b2cb1fb5aee35eeddefcee15870cb470aa0d3d
Opcode Fuzzy Hash: 8eb7e9acec1751e613be6750b9c04c95c48d5d700aaadb3b6e51bf6b1cebdfde
Instruction Fuzzy Hash: 1C218E20F0D64382FA68E7755A5257D66925F857B0F380734E92FCBAD6EE2CB442830C

Function 00007FF608080CA0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF608080CD1
GetLastError.KERNEL32 ref: 00007FF608080CDD
CloseHandle.KERNEL32 ref: 00007FF608080CF5
CreateFileW.KERNEL32 ref: 00007FF608080D20
WriteConsoleW.KERNEL32 ref: 00007FF608080D3F

Strings

CONOUT$, xrefs: 00007FF608080D01

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: eccb84783a33b6acb2369927ad856cb4a6f1e39df1dbbcb1c74e1911e2e9c731
Instruction ID: 57cead7593419f7ad3ff2c2afd2dc33a8854c90de71cdc5fdc2022e34017f072
Opcode Fuzzy Hash: eccb84783a33b6acb2369927ad856cb4a6f1e39df1dbbcb1c74e1911e2e9c731
Instruction Fuzzy Hash: 78115421718B42C6E754CBA2E844729A7A0FB88BE4F284234D95EC7B94DFBCD5448748

Function 00007FF60807A010 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF60807C125,?,?,?,?,00007FF608077D08,?,?,?,?,00007FF608074E74), ref: 00007FF60807A01F
FlsSetValue.KERNEL32(?,?,?,00007FF60807C125,?,?,?,?,00007FF608077D08,?,?,?,?,00007FF608074E74), ref: 00007FF60807A055
FlsSetValue.KERNEL32(?,?,?,00007FF60807C125,?,?,?,?,00007FF608077D08,?,?,?,?,00007FF608074E74), ref: 00007FF60807A082
FlsSetValue.KERNEL32(?,?,?,00007FF60807C125,?,?,?,?,00007FF608077D08,?,?,?,?,00007FF608074E74), ref: 00007FF60807A093
FlsSetValue.KERNEL32(?,?,?,00007FF60807C125,?,?,?,?,00007FF608077D08,?,?,?,?,00007FF608074E74), ref: 00007FF60807A0A4
SetLastError.KERNEL32(?,?,?,00007FF60807C125,?,?,?,?,00007FF608077D08,?,?,?,?,00007FF608074E74), ref: 00007FF60807A0BF

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b62c077a2562629968d0e64dfe6611344bf88aff198bfc4a34faf3d636af4a9f
Instruction ID: 21150acda33a802f321add73ea24685614aefb028d2e56eccb6a4de7821702ee
Opcode Fuzzy Hash: b62c077a2562629968d0e64dfe6611344bf88aff198bfc4a34faf3d636af4a9f
Instruction Fuzzy Hash: 2D116A20F0D21282FA58E3755A5257DA2926F857B0F380A34E82FC76D6DE6CA441838C

Function 00007FF60807E510 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF60807E58F
WriteFile.KERNEL32 ref: 00007FF60807E857
WriteFile.KERNEL32 ref: 00007FF60807E89D
GetLastError.KERNEL32 ref: 00007FF60807E953

Strings

MZx, xrefs: 00007FF60807E566, 00007FF60807E5E7, 00007FF60807E69C

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: 6ce917d528adb3b7ec2eb0403480b4a9e68144bd1b8ad96170a743d827fd017e
Instruction ID: 1badf4745675719ff1fc96fff321145c4c9661e84d8a63d6e3dd76ad601a8fdf
Opcode Fuzzy Hash: 6ce917d528adb3b7ec2eb0403480b4a9e68144bd1b8ad96170a743d827fd017e
Instruction Fuzzy Hash: FFD1F132F0AA8189E751CFB9D4402AC37B1FB44B98B644276DE5E97BD9DE38D016C348

Function 00007FF608076790 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6080767B5
GetProcAddress.KERNEL32 ref: 00007FF6080767CB
FreeLibrary.KERNEL32 ref: 00007FF6080767F2

Strings

mscoree.dll, xrefs: 00007FF6080767AC
CorExitProcess, xrefs: 00007FF6080767C4

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 56dec27a48c382bae8c9dbc998320d3297bdff6e0d22f776c03b946996f6de0c
Instruction ID: 66e2ea5acac81d5a462cdf3ef438c3d1b5e8940740be0c163bda62ad3237f562
Opcode Fuzzy Hash: 56dec27a48c382bae8c9dbc998320d3297bdff6e0d22f776c03b946996f6de0c
Instruction Fuzzy Hash: 14F04FA1B19B0281EA18CB74A4443796360EF897A1F680635C96EC92E4CF6DD548C318

Function 00007FF6080815E0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF608081608
_set_statfp.LIBCMT ref: 00007FF608081623
_set_statfp.LIBCMT ref: 00007FF60808163F
_set_statfp.LIBCMT ref: 00007FF60808167B

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction ID: ba5d86ecab265a73e0bf3fc4cf994d4798ac3bb0f6485e9b249561d8a3ab956d
Opcode Fuzzy Hash: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction Fuzzy Hash: 24114FB2E18A03C5F7569134E45637530406F653B0E3C0A34E9EF862E68EECA8D2450C

Function 00007FF60807A0D8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF608077A3F,?,?,00000000,00007FF6080778EE,?,?,?,?,?,00007FF608077B02), ref: 00007FF60807A0F7
FlsSetValue.KERNEL32(?,?,?,00007FF608077A3F,?,?,00000000,00007FF6080778EE,?,?,?,?,?,00007FF608077B02), ref: 00007FF60807A116
FlsSetValue.KERNEL32(?,?,?,00007FF608077A3F,?,?,00000000,00007FF6080778EE,?,?,?,?,?,00007FF608077B02), ref: 00007FF60807A13E
FlsSetValue.KERNEL32(?,?,?,00007FF608077A3F,?,?,00000000,00007FF6080778EE,?,?,?,?,?,00007FF608077B02), ref: 00007FF60807A14F
FlsSetValue.KERNEL32(?,?,?,00007FF608077A3F,?,?,00000000,00007FF6080778EE,?,?,?,?,?,00007FF608077B02), ref: 00007FF60807A160

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 315fd457ddef81b560e09b51ca76df7db0b77885c296541c44264b052bdf0a77
Instruction ID: 072324a36751122cd7c4d122e8074f1ac7f961dc203fde061acfacc6c24b4ac3
Opcode Fuzzy Hash: 315fd457ddef81b560e09b51ca76df7db0b77885c296541c44264b052bdf0a77
Instruction Fuzzy Hash: C9114920F0D25245FA98D779A95267D62926F857F0E384738E92FC76D6DE2CA842820C

Function 00007FF608079F6C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF608079F7D
FlsSetValue.KERNEL32 ref: 00007FF608079F9C
FlsSetValue.KERNEL32 ref: 00007FF608079FC4
FlsSetValue.KERNEL32 ref: 00007FF608079FD5
FlsSetValue.KERNEL32 ref: 00007FF608079FE6

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3583ea58da392ae5e1a25b37852758e3d7efc9f279aafc2945d021ad744b599d
Instruction ID: 1b32e4cebb165a31089c640a8cdcdd6c9a1efc695e83c3b7e420408cbb8ead8b
Opcode Fuzzy Hash: 3583ea58da392ae5e1a25b37852758e3d7efc9f279aafc2945d021ad744b599d
Instruction Fuzzy Hash: 54112D60F0D20741FA7CE77958626BE25925F86370E380B38E93FCA2D2DD2CB442825D

Function 00007FF608075A88 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF608075AB3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF608075B4A
RtlUnwindEx.KERNEL32 ref: 00007FF608075BA4

Strings

csm, xrefs: 00007FF608075B31

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b8fdca9cded4bbb6aa06f1f5ade378c1037bc301aacae7e2f84c1045c81e75ca
Instruction ID: 959e9f52fb52e752eb25b30e6a35b0e2236ccf789e64bab6e5c85cfd625fdc21
Opcode Fuzzy Hash: b8fdca9cded4bbb6aa06f1f5ade378c1037bc301aacae7e2f84c1045c81e75ca
Instruction Fuzzy Hash: 93517E32E196028AEB14CF25E844BBD6391EB44B98F658535EA4B877C8DF7DE841870C

Function 00007FF60807891C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF608078D4C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF608078E34

Strings

csm, xrefs: 00007FF608078E86
csm, xrefs: 00007FF608078D6E

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: dad56c49b405efa0f0b0dfcbe895a6a6fea9ee740eef188aff0589e1bfe89b6b
Instruction ID: 5c48bb9da7b32dab3b217d96e45d4b03e27200f8cfc54ea481ea232098eaff29
Opcode Fuzzy Hash: dad56c49b405efa0f0b0dfcbe895a6a6fea9ee740eef188aff0589e1bfe89b6b
Instruction Fuzzy Hash: A3615D32D086828AEB74CA25954837877A1FB59B94F248135DA9EC7BD5CF3CE890C70D

Function 00007FF608079500 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF60807955F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6080795AB

Strings

RCC, xrefs: 00007FF60807957B
MOC, xrefs: 00007FF608079573

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: ba93ea01ede6b7901e4f1a42dd3188ba1bf94f5b48d2c5fd38b2079bf7c360a5
Instruction ID: 83df5bff2acae940f7ad6cba12498dbbf41047ee67c0ed67399fdefff9e6b455
Opcode Fuzzy Hash: ba93ea01ede6b7901e4f1a42dd3188ba1bf94f5b48d2c5fd38b2079bf7c360a5
Instruction Fuzzy Hash: B461A172D08BC581D760DF25E4407AABBA0FB85B84F144225EB9E47B99DF3CE191CB08

Function 00007FF60807E0E8 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF60807E4FB), ref: 00007FF60807E204
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF60807E4FB), ref: 00007FF60807E28F

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 88b8c225d62e374fe023bc9d5a4caf48daae308facaf316e88f45816378adbdd
Instruction ID: 78f891f23ca4cf52c0c69f682c0cf395e543fa3e7f7f6b10fc385c1f1fd1c337
Opcode Fuzzy Hash: 88b8c225d62e374fe023bc9d5a4caf48daae308facaf316e88f45816378adbdd
Instruction Fuzzy Hash: F691BF72F0965289F764CF75C4452BD2BA0AB45B88F644179DE0FA6AC5DE38E482C70C

Function 00007FF608078A64 Relevance: 6.2, APIs: 4, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF608078B87
__AdjustPointer.LIBCMT ref: 00007FF608078BD2
__AdjustPointer.LIBCMT ref: 00007FF608078CA9

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 506d3401bf5a93b8ca173106f1f1787cf44583c133506b40ded6fba249d7dab6
Instruction ID: 5756d54971246d1bdff0b4c73555a4daf366951b2d4761798aca16d318fbad2f
Opcode Fuzzy Hash: 506d3401bf5a93b8ca173106f1f1787cf44583c133506b40ded6fba249d7dab6
Instruction Fuzzy Hash: F471C062E0AA4681FE65DA31958857D6794EF54B80F29C835DF4F87BC5DE3CE482830C

Function 00007FF608076BBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF608076BEE

Part of subcall function 00007FF60807B380: RtlFreeHeap.NTDLL(?,?,?,00007FF60807BF8A,?,?,?,00007FF60807BE8B,?,?,00000000,00007FF60807C9A9,?,?,?,00007FF60807C8B3), ref: 00007FF60807B396
Part of subcall function 00007FF60807B380: GetLastError.KERNEL32(?,?,?,00007FF60807BF8A,?,?,?,00007FF60807BE8B,?,?,00000000,00007FF60807C9A9,?,?,?,00007FF60807C8B3), ref: 00007FF60807B3A0

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF608074EAD), ref: 00007FF608076C0C

Strings

C:\Users\user\Desktop\soft 1.14.exe, xrefs: 00007FF608076BFA

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\soft 1.14.exe
API String ID: 3580290477-904005308
Opcode ID: a645f223ce12f83b0f8d23c07915082202de851ed736994d0ec83cfc9196f6a2
Instruction ID: ae86d60345b59bb6e877a87702eef38fc5d5682dfc04230c276bff6d9cae5f92
Opcode Fuzzy Hash: a645f223ce12f83b0f8d23c07915082202de851ed736994d0ec83cfc9196f6a2
Instruction Fuzzy Hash: 2C417C32E08B068AE718EF31E8510BD37A4FB45B94B644035EA5FC7B95DE3DE8818348

Function 00007FF60807EBA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF60807ECBF
GetLastError.KERNEL32 ref: 00007FF60807ECE1

Strings

U, xrefs: 00007FF60807EC6B

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6e6dc1b65bfd63166fd0bb342432b01ffd91828e93f14cbc7104de6985ace0a7
Instruction ID: e5fa4db588a15c04eaa171f03ee741d8df3e0027dc38ee080bc088217e56b635
Opcode Fuzzy Hash: 6e6dc1b65bfd63166fd0bb342432b01ffd91828e93f14cbc7104de6985ace0a7
Instruction Fuzzy Hash: 0B41B262B19B4185EB20CF35E4443A967A0FB98B94FA44031EE4EC7798DF7CD442C748

Function 00007FF6080759E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF608074E57), ref: 00007FF608075A30
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF608074E57), ref: 00007FF608075A71

Strings

csm, xrefs: 00007FF608075A5E

Memory Dump Source

Source File: 00000000.00000002.1675361008.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000000.00000002.1675345618.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675384226.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675569765.00007FF60838D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675589059.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675619460.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 967fbbe814c9c1e701ed63cdd0d532d980ddcea8b093fe1b68fbd27a0b08e2d1
Instruction ID: 3663f0858507ac6a770d823c2188b2fb1595d4125fae17c7c3bd45300161abc4
Opcode Fuzzy Hash: 967fbbe814c9c1e701ed63cdd0d532d980ddcea8b093fe1b68fbd27a0b08e2d1
Instruction Fuzzy Hash: 20116032A18B8182EB20CF25F840259B7E5FB88B94F684230DE8D47759DF3CD551C704

Analysis Process: soft 1.14.exePID: 7544, Parent PID: 7528COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 00000001400849D0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 0000000140084A11
GetSystemMetrics.USER32 ref: 0000000140084A1F
GetSystemMetrics.USER32 ref: 0000000140084A2D
GetSystemMetrics.USER32 ref: 0000000140084A3B
GetDC.USER32 ref: 0000000140084A45
GetDeviceCaps.GDI32 ref: 0000000140084A5B
GetDeviceCaps.GDI32 ref: 0000000140084A6B
CreateCompatibleDC.GDI32 ref: 0000000140084A78
CreateCompatibleBitmap.GDI32 ref: 0000000140084A90
SelectObject.GDI32 ref: 0000000140084AA6
BitBlt.GDI32 ref: 0000000140084ADC
SHCreateMemStream.SHLWAPI ref: 0000000140084B12
SelectObject.GDI32 ref: 0000000140084B28
DeleteDC.GDI32 ref: 0000000140084B31
ReleaseDC.USER32 ref: 0000000140084B3C
DeleteObject.GDI32 ref: 0000000140084B45
EnterCriticalSection.KERNEL32 ref: 0000000140084C3C
LeaveCriticalSection.KERNEL32 ref: 0000000140084C4E
IStream_Size.SHLWAPI ref: 0000000140084C85
IStream_Reset.SHLWAPI ref: 0000000140084C96
IStream_Read.SHLWAPI ref: 0000000140084D1B
SelectObject.GDI32 ref: 0000000140084D75
DeleteDC.GDI32 ref: 0000000140084D7E
ReleaseDC.USER32 ref: 0000000140084D8B
DeleteObject.GDI32 ref: 0000000140084D94

Strings

, xrefs: 0000000140084AB1

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: b8ad9de3582fef1955ac4035c1c75ac334f415ebc7e19910e4ff908aacfd4282
Instruction ID: 8a9b4e0b064338a6d8d553899a54bca9af0a5e421b87f50a1b45792b9aa8e9a5
Opcode Fuzzy Hash: b8ad9de3582fef1955ac4035c1c75ac334f415ebc7e19910e4ff908aacfd4282
Instruction Fuzzy Hash: 91B11B72618BC086E761DB22E8543DEB7A5F789BC0F508615EA8E43B69DF3CC185CB10

Function 0000000140086BE0 Relevance: 22.6, APIs: 3, Strings: 9, Instructions: 1600COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140085AD0: GetCurrentHwProfileW.ADVAPI32 ref: 0000000140085B0C

Part of subcall function 00000001400853A0: EnumDisplayDevicesW.USER32 ref: 00000001400854B7
Part of subcall function 00000001400853A0: EnumDisplayDevicesW.USER32 ref: 000000014008555B

Part of subcall function 00000001400852C0: RegGetValueA.ADVAPI32 ref: 0000000140085329

Part of subcall function 0000000140084FB0: GetUserNameW.ADVAPI32 ref: 0000000140084FF5

Part of subcall function 0000000140085050: GetComputerNameW.KERNEL32 ref: 0000000140085095

GlobalMemoryStatusEx.KERNEL32 ref: 000000014008736C
wcsftime.LIBCMT ref: 0000000140087B62
GetModuleFileNameA.KERNEL32 ref: 0000000140087CF6

Strings

%d-%m-%Y, %H:%M:%S, xrefs: 0000000140087B4F
timezone, xrefs: 0000000140088004
time, xrefs: 0000000140087C31
system, xrefs: 0000000140086FD4, 00000001400870C3, 00000001400871B9, 00000001400872B3, 00000001400873FB, 00000001400874F5, 00000001400875E8, 000000014008776F, 0000000140087960, 0000000140087BE1, 0000000140087DA4, 0000000140087FBE, 000000014008815D, 0000000140088307, 00000001400883CD
user_name, xrefs: 000000014008701F
gpu, xrefs: 0000000140087112
cpu, xrefs: 0000000140087208
ram, xrefs: 000000014008744B
computer_name, xrefs: 0000000140087544

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: a46e5203c657c07eb4b7182e7fef379a7db23a876a87c17c3647340b6bfc226d
Instruction ID: 0cfcea1034b7f9981394cb5387c0e5e44c922b0cc561fc60f0db12949e2aba7b
Opcode Fuzzy Hash: a46e5203c657c07eb4b7182e7fef379a7db23a876a87c17c3647340b6bfc226d
Instruction Fuzzy Hash: DDF26B73614BC085DB22CB26E8903DD77A1F799798F419616FB8D17BA9EB78C290C700

Function 000000014003C5E0 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014003C6CC
GetProcAddress.KERNEL32 ref: 000000014003C7D7
GetProcAddress.KERNEL32 ref: 000000014003C899
GetProcAddress.KERNEL32 ref: 000000014003C913
GetProcAddress.KERNEL32 ref: 000000014003C995
GetProcAddress.KERNEL32 ref: 000000014003CA0F
GetProcAddress.KERNEL32 ref: 000000014003CA93
FreeLibrary.KERNEL32 ref: 000000014003D5C1

Strings

vault, xrefs: 000000014003D423
system, xrefs: 000000014003D3CD
cannot use push_back() with , xrefs: 000000014003D60F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 0d948670e934948f9399bcc25d98691fce76d742d32ec229edf0addd9f7a4c44
Instruction ID: 2ec4e2a7ae8c91d38f5a8356c21f69af9047b71e87f6ad347462173074feb4f2
Opcode Fuzzy Hash: 0d948670e934948f9399bcc25d98691fce76d742d32ec229edf0addd9f7a4c44
Instruction Fuzzy Hash: 3F925E72205BC489DB628F26E8843DE77B4F749798F104216EB9D4BBA9EF74C694C300

Function 000000014007B500 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 161
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007E710: GetCurrentProcess.KERNEL32 ref: 000000014007E74B
Part of subcall function 000000014007E710: OpenProcessToken.ADVAPI32 ref: 000000014007E75E
Part of subcall function 000000014007E710: GetTokenInformation.ADVAPI32 ref: 000000014007E79A
Part of subcall function 000000014007E710: CloseHandle.KERNEL32 ref: 000000014007E7BB

ExitProcess.KERNEL32 ref: 000000014007B547
OpenMutexA.KERNEL32 ref: 000000014007B662
ExitProcess.KERNEL32 ref: 000000014007B672
CreateMutexA.KERNEL32 ref: 000000014007B691
ExitProcess.KERNEL32 ref: 000000014007B6B7

Part of subcall function 000000014007EA50: GetModuleFileNameW.KERNEL32 ref: 000000014007EA9A

Part of subcall function 0000000140089330: CoInitializeEx.OLE32 ref: 000000014008939A

Strings

SeDebugPrivilege, xrefs: 000000014007B54E
SeImpersonatePrivilege, xrefs: 000000014007B55A

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CloseCreateCurrentFileHandleInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 4279366119-3768118664
Opcode ID: c15579a596aae32c568705457757ddd2bb20bc35d715638889c75400a0ff4399
Instruction ID: 962da8f413caa45279bf650923a9d6b93aba050168666a2f2076e0c646855bcd
Opcode Fuzzy Hash: c15579a596aae32c568705457757ddd2bb20bc35d715638889c75400a0ff4399
Instruction Fuzzy Hash: AF619F72218A8581EA26AB66E4553EEA391FBCD7C4F505615F78E43AF6EF3CC040CB11

Function 0000000140034B70 Relevance: 15.3, APIs: 3, Strings: 5, Instructions: 1343registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014003509B
RegQueryValueExA.ADVAPI32 ref: 00000001400350E9
RegCloseKey.ADVAPI32 ref: 0000000140035186

Strings

status, xrefs: 0000000140036403, 0000000140036413
directory_iterator::directory_iterator, xrefs: 0000000140036441
filename, xrefs: 000000014003549A, 0000000140035A28, 0000000140035F59
exists, xrefs: 0000000140036398, 00000001400363E3, 000000014003647A
content, xrefs: 00000001400355A3, 0000000140035BF6, 0000000140036120

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3677997916-3429737954
Opcode ID: 175320917f964c83a506369eff2fb3a54cecadb9ef131e354b589dabf4103beb
Instruction ID: 23406d12f56c9c9c5856e535017d7a69c74f1142575ed8a38387d0c1f75b00f7
Opcode Fuzzy Hash: 175320917f964c83a506369eff2fb3a54cecadb9ef131e354b589dabf4103beb
Instruction Fuzzy Hash: 81E25F72614BC08AEB62DF35D8803DD73A5F789798F505216EB9D4BAA9EF74C684C300

Function 0000000140032CA0 Relevance: 14.8, APIs: 3, Strings: 5, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140033022
RegQueryValueExA.ADVAPI32 ref: 000000014003306A
RegCloseKey.ADVAPI32 ref: 00000001400330F7

Strings

status, xrefs: 00000001400339F9
directory_iterator::directory_iterator, xrefs: 00000001400339DD
filename, xrefs: 0000000140033500
exists, xrefs: 00000001400339BE
content, xrefs: 0000000140033694

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3677997916-3429737954
Opcode ID: bd29fab57e6ba89ddd447dda21f70310d0c0f8bbbc31d0296f751e6485ff42c4
Instruction ID: 62805d46291fcd4fccf0c70bfe2eedc485df16924868f35b375ef2d556690b27
Opcode Fuzzy Hash: bd29fab57e6ba89ddd447dda21f70310d0c0f8bbbc31d0296f751e6485ff42c4
Instruction Fuzzy Hash: FB825C72611BC48AEB228F36D8803DE73A1F789798F505216EB9D57BA9EF74C584C300

Function 00000001400A16FC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400A1741

Part of subcall function 00000001400A0DA8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A0DBC

Part of subcall function 000000014009BC88: HeapFree.KERNEL32 ref: 000000014009BC9E
Part of subcall function 000000014009BC88: GetLastError.KERNEL32 ref: 000000014009BCA8

Part of subcall function 00000001400AA344: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AA28F

_get_daylight.LIBCMT ref: 00000001400A1730

Part of subcall function 00000001400A0E08: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A0E1C

_get_daylight.LIBCMT ref: 00000001400A19A6
_get_daylight.LIBCMT ref: 00000001400A19B7
_get_daylight.LIBCMT ref: 00000001400A19C8
GetTimeZoneInformation.KERNEL32 ref: 00000001400A19EF

Strings

Eastern Summer Time, xrefs: 00000001400A1AAD
Eastern Standard Time, xrefs: 00000001400A1A95

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 4e267fd81a7984b2af7afa71f05677820aec786affd320299b4762449731f59c
Instruction ID: 0e2af64cfaed83a3ab014c0441055b0818baa83ef077c612d66b586912d86e0e
Opcode Fuzzy Hash: 4e267fd81a7984b2af7afa71f05677820aec786affd320299b4762449731f59c
Instruction Fuzzy Hash: 40D1E43670064086E762EF67E8513E967A1F7ACBD4F448225FF4947AE5DB38D481CB40

Function 00000001400840A0 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000000014008426B
InternetOpenUrlA.WININET ref: 0000000140084348
HttpQueryInfoW.WININET ref: 00000001400843A9
HttpQueryInfoW.WININET ref: 0000000140084442
InternetQueryDataAvailable.WININET ref: 0000000140084486
InternetReadFile.WININET ref: 0000000140084549
InternetQueryDataAvailable.WININET ref: 0000000140084614
InternetCloseHandle.WININET ref: 00000001400846BE
Concurrency::cancel_current_task.LIBCPMT ref: 000000014008471B

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: 5564f8b7e3b8cda5b9e7844f531143998aac2b6f73e955ce09d41620cba67f2b
Instruction ID: f0be8985bf0e26381fb0b58506fa69bef840138c90a8d4bbed39db66bf6f3b00
Opcode Fuzzy Hash: 5564f8b7e3b8cda5b9e7844f531143998aac2b6f73e955ce09d41620cba67f2b
Instruction Fuzzy Hash: 27024933A14B9486EB11CB6AE84039E77A5F7997D8F104215FF9857BA9EF78C190C700

Function 00000001400BEF18 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400BEAFC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BEB3D
Part of subcall function 00000001400BEAFC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BEBBB
Part of subcall function 00000001400BEAFC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BEC0C

CreateFileW.KERNEL32 ref: 00000001400BF01E
CreateFileW.KERNEL32 ref: 00000001400BF06E
GetLastError.KERNEL32 ref: 00000001400BF09E
GetFileType.KERNEL32 ref: 00000001400BF0B3
GetLastError.KERNEL32 ref: 00000001400BF0BD
CloseHandle.KERNEL32 ref: 00000001400BF0F0
CloseHandle.KERNEL32 ref: 00000001400BF253
CreateFileW.KERNEL32 ref: 00000001400BF288
GetLastError.KERNEL32 ref: 00000001400BF297

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: ad973e6908b5c5e029224e3ab01ca94b19cb4adaabd133e22d80478e6497b413
Instruction ID: 320eb96e718149e4e7e60864c9bbf8eacca92e1ca184eaa25a96958780752bf2
Opcode Fuzzy Hash: ad973e6908b5c5e029224e3ab01ca94b19cb4adaabd133e22d80478e6497b413
Instruction Fuzzy Hash: 41C1AB76720A418AEB11CFAAC4917EC37B1E74DBE8F115615EB2A9B7A5CB38C452C700

Function 0000000140065250 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

status, xrefs: 0000000140069500, 00000001400695D9, 0000000140069690, 0000000140069763, 0000000140069785, 000000014006979B, 00000001400697BD
recursive_directory_iterator::operator++, xrefs: 0000000140069578, 0000000140069645, 0000000140069708
directory_iterator::directory_iterator, xrefs: 0000000140069753, 0000000140069775, 00000001400697AD
cannot use push_back() with , xrefs: 0000000140069525, 00000001400695FE, 00000001400696B5
exists, xrefs: 00000001400694DE, 00000001400695AC, 000000014006966E, 000000014006973C
recursive_directory_iterator::recursive_directory_iterator, xrefs: 000000014006958F, 00000001400695C9, 000000014006971F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: faa1d1145ba5e556b848c73fd33eef50efad81b8938a0009e7cdda006ddcc96c
Instruction ID: 031dd4974e96f4dd573688d53c9078fa1c6111530a30c886699dc0fc79c76709
Opcode Fuzzy Hash: faa1d1145ba5e556b848c73fd33eef50efad81b8938a0009e7cdda006ddcc96c
Instruction Fuzzy Hash: FED21272519BC885D6718B1AF88139BB3A1F79D784F505229EBCD53B69EB7CC290CB00

Function 00000001400320B0 Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 684
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140032409
RegQueryValueExA.ADVAPI32 ref: 000000014003244E
RegCloseKey.ADVAPI32 ref: 00000001400324F7

Strings

directory_iterator::directory_iterator, xrefs: 0000000140032C64
filename, xrefs: 0000000140032787
exists, xrefs: 0000000140032C42
content, xrefs: 0000000140032915

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 3677997916-1400943384
Opcode ID: 2316d6660ad33f69ae55bd29c0a13a611ed398c49c268220a2994983f1843a00
Instruction ID: fdd2384dfce0150235b7be390f6418f44b90b76628f1849b6480400e0b2e9a5f
Opcode Fuzzy Hash: 2316d6660ad33f69ae55bd29c0a13a611ed398c49c268220a2994983f1843a00
Instruction Fuzzy Hash: 7D724C72611BC499EB228F36D8803DD77A0F789798F109215EB9D5BBA9EF74C680C340

Function 000000014007DF10 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000000014007E151
SetFilePointer.KERNEL32 ref: 000000014007E204
ReadFile.KERNEL32 ref: 000000014007E233

Strings

ios_base::badbit set, xrefs: 000000014007E661, 000000014007E6DF
ios_base::eofbit set, xrefs: 000000014007E674
ios_base::failbit set, xrefs: 000000014007E66D
exists, xrefs: 000000014007E6BA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 0683f384183c2aee485083eaa643c96062efc2106c8fae226bcd34debfb2e5c9
Instruction ID: a7efa278b789a091a952ecf7804818e508a819529244d4e7b1ee4b8bfe63f7b0
Opcode Fuzzy Hash: 0683f384183c2aee485083eaa643c96062efc2106c8fae226bcd34debfb2e5c9
Instruction Fuzzy Hash: 69322632611BC489EB21CF35D8807DD77A1F789B88F508226EB8D5BBA9EB74C645C700

Function 00000001400A1978 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400A19A6

Part of subcall function 00000001400A0E08: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A0E1C

_get_daylight.LIBCMT ref: 00000001400A19B7

Part of subcall function 00000001400A0DA8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A0DBC

_get_daylight.LIBCMT ref: 00000001400A19C8

Part of subcall function 00000001400A0DD8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A0DEC

Part of subcall function 000000014009BC88: HeapFree.KERNEL32 ref: 000000014009BC9E
Part of subcall function 000000014009BC88: GetLastError.KERNEL32 ref: 000000014009BCA8

GetTimeZoneInformation.KERNEL32 ref: 00000001400A19EF

Strings

Eastern Summer Time, xrefs: 00000001400A1AAD
Eastern Standard Time, xrefs: 00000001400A1A95

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 79a3bef5671be3ea62fc3f2afacbfa5a121da07fba2b20aeaa9856bd679d23df
Instruction ID: 4ab37d3fa7c9fdb582fe448a726573fe52a466e20a16ed51a879e3e0b2c8cc1e
Opcode Fuzzy Hash: 79a3bef5671be3ea62fc3f2afacbfa5a121da07fba2b20aeaa9856bd679d23df
Instruction Fuzzy Hash: 8951613621064086F762EF67F9817D97760F7ACBC4F444626FB4987AB6DB38D4818B40

Function 0000000140097A4C Relevance: 9.2, APIs: 6, Instructions: 227COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140097A6E
_get_daylight.LIBCMT ref: 0000000140097ACE
_get_daylight.LIBCMT ref: 0000000140097ADF
_get_daylight.LIBCMT ref: 0000000140097AF0
_isindst.LIBCMT ref: 0000000140097B41
_isindst.LIBCMT ref: 0000000140097B94

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 500d264b94c76e10bb7ad506ef0a555ed75bc66b43a59da6eb24dc754e51f7a2
Instruction ID: 28c35c292e486cd51e7828065e4e2486622d87188324d2f30eb372141ce4aa21
Opcode Fuzzy Hash: 500d264b94c76e10bb7ad506ef0a555ed75bc66b43a59da6eb24dc754e51f7a2
Instruction Fuzzy Hash: 1A81C7B3B012458BEB598F36D9417EC63A5E798BC8F049129EB0D8B7A9EB38D541C740

Function 0000000140048E80 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 417COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140049034
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140049042
__std_exception_destroy.LIBVCRUNTIME ref: 00000001400492C5
__std_exception_destroy.LIBVCRUNTIME ref: 00000001400492D3

Strings

value, xrefs: 0000000140048F5A, 00000001400491F3

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: f3ab481adf26e7fc62f689a1b14253d57f24bd398a58451cc93ee0ee3af88f39
Instruction ID: 4157f297126a23fe588f45231007c796bee3a81a254ffe5b804a119b388bf979
Opcode Fuzzy Hash: f3ab481adf26e7fc62f689a1b14253d57f24bd398a58451cc93ee0ee3af88f39
Instruction Fuzzy Hash: 17028B72624BC085EB02DB76D4803ED6761E78A7E4F515222FB9E43AEADF78C185C700

Function 000000014003D680 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003D6CA
Process32FirstW.KERNEL32 ref: 000000014003D70C
Process32NextW.KERNEL32 ref: 000000014003D903
CloseHandle.KERNEL32 ref: 000000014003DB7A

Strings

[PID: , xrefs: 000000014003D74E

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 0c950f8b155bc2ef1efead22239ab0028e84ac47bfa0f278c3d4f43e35984d4a
Instruction ID: cece93d552114422a5db79efb6cb5b095d6d34e54e317ad826c2fed787882349
Opcode Fuzzy Hash: 0c950f8b155bc2ef1efead22239ab0028e84ac47bfa0f278c3d4f43e35984d4a
Instruction Fuzzy Hash: 54E16172614BC085EB22DB26E8803DE77A5F7897A4F505216FB9D47BA9DF78C284C700

Function 000000014008A560 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014008A5AE
OpenProcessToken.ADVAPI32 ref: 000000014008A5C1
LookupPrivilegeValueW.ADVAPI32 ref: 000000014008A5E2
AdjustTokenPrivileges.ADVAPI32 ref: 000000014008A628
CloseHandle.KERNEL32 ref: 000000014008A648

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 012d78ec9778671e051357f93a4634913505e7a4763b4c3b036141e78afb5143
Instruction ID: e6ed573dd5adc179a62c0c43ff1dd623381a8e6f68e1d36954cd8c9a6a60e3b9
Opcode Fuzzy Hash: 012d78ec9778671e051357f93a4634913505e7a4763b4c3b036141e78afb5143
Instruction Fuzzy Hash: 8E215C32218B8082E761CF22F45439AB7A0FB8DBD0F598125FB8947B68DF7DC5568B00

Function 000000014003BA80 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000000014003BAE2
CredFree.ADVAPI32 ref: 000000014003C506

Strings

cannot use push_back() with , xrefs: 000000014003C554

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 10ff68bfcf696204dfea02bd2271975a172f589f5c10e72978e025579e9ae02f
Instruction ID: 15e837bc0680750b5105bb68f1ec756bb9003d5bb125d07902e424ac5bc16deb
Opcode Fuzzy Hash: 10ff68bfcf696204dfea02bd2271975a172f589f5c10e72978e025579e9ae02f
Instruction Fuzzy Hash: 34627D72614BC489EB228F26E8803DE7761F789798F504316EBAD57BA9DB74C294C700

Function 0000000140086250 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 0000000140086580

Strings

[UTC, xrefs: 0000000140086553

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: dae8efce5d2530c78139cd26f997094fb4b1ed245d954789b40324fff528bad9
Instruction ID: 0f088bd619a210dec1cb0986f13bb44e3f6854156ff9e1ffbd8192f932ae259b
Opcode Fuzzy Hash: dae8efce5d2530c78139cd26f997094fb4b1ed245d954789b40324fff528bad9
Instruction Fuzzy Hash: 5CB12832614BC88AD7718F2AE84139AB7A5F79C788F105315EBCC57B69EB78C250CB44

Function 000000014007B7D0 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014007B833
ShellExecuteW.SHELL32 ref: 000000014007BE7A

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 8cf5c74d64a0911ccf009ca7f061b764517e4121d83dc6aa143f050b31a04890
Instruction ID: fcdc6028fe68c1de9c1d61a4c27d8a3d82f381935235dac80c5d4554a44c27d4
Opcode Fuzzy Hash: 8cf5c74d64a0911ccf009ca7f061b764517e4121d83dc6aa143f050b31a04890
Instruction Fuzzy Hash: AA121772625F848ADB418F2AE88079EB3A4F788788F506215FFDD57B69EB38C150C700

Function 0000000140076AA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140076AF8
LocalFree.KERNEL32 ref: 0000000140076B8A

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 0f57a5f6f00cf3114cdad985b88ad97b4443b737a92ed5702ae11a0636d70846
Instruction ID: 7804563b8dd68e9e0661087fd5dbb69b584154c51fa0838d7a27f1f595743b83
Opcode Fuzzy Hash: 0f57a5f6f00cf3114cdad985b88ad97b4443b737a92ed5702ae11a0636d70846
Instruction Fuzzy Hash: FC416032614B80CAE3219F75E4403ED37A4F75978CF084229BB8907E9ADB79C6A4C758

Function 0000000140084FB0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0000000140084FF5

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e5988426a38de09ee6cf2dd1c57c0096c2fcff121a7d67ee165aa271772a2a34
Instruction ID: 4cc3c8844ba736298f8bd32032979993a0d240d019a900159361ccb08714f342
Opcode Fuzzy Hash: e5988426a38de09ee6cf2dd1c57c0096c2fcff121a7d67ee165aa271772a2a34
Instruction Fuzzy Hash: FC011B3261868082E762DF26E8513DAB3A4F79C7C8F441226FB8D47669DBBCC194CB40

Function 000000014007DAE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007D860: InitializeCriticalSectionEx.KERNEL32 ref: 000000014007D8B1
Part of subcall function 000000014007D860: GetLastError.KERNEL32 ref: 000000014007D8BB

EnterCriticalSection.KERNEL32 ref: 000000014007DB21
GdiplusStartup.GDIPLUS ref: 000000014007DB48
LeaveCriticalSection.KERNEL32 ref: 000000014007DB56
LeaveCriticalSection.KERNEL32 ref: 000000014007DB84
GdipGetImageEncodersSize.GDIPLUS ref: 000000014007DB92
GdipGetImageEncoders.GDIPLUS ref: 000000014007DC26
GdipCreateBitmapFromScan0.GDIPLUS ref: 000000014007DCF0
GdipSaveImageToStream.GDIPLUS ref: 000000014007DD0E
GdipDisposeImage.GDIPLUS ref: 000000014007DD73
GdipDisposeImage.GDIPLUS ref: 000000014007DD87

Strings

&, xrefs: 000000014007DCEA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: 0b8d952391a50375ef43d6746334d8a0080f61def9520b6ac6a34ec75f65a789
Instruction ID: 9499a8a96b76f9eeaec96d38e309a061bbf0e919148de72399f1f56bad800c58
Opcode Fuzzy Hash: 0b8d952391a50375ef43d6746334d8a0080f61def9520b6ac6a34ec75f65a789
Instruction Fuzzy Hash: EE911932200B819AEB229F22E8407D977B4F75CBD8F558217FB5957BA4DB38C995C380

Function 000000014007EB00 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 226
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140084730: GetUserGeoID.KERNEL32 ref: 0000000140084757
Part of subcall function 0000000140084730: GetGeoInfoA.KERNEL32 ref: 0000000140084771
Part of subcall function 0000000140084730: GetGeoInfoA.KERNEL32 ref: 00000001400847C1

WSAStartup.WS2_32 ref: 000000014007EC1E
socket.WS2_32 ref: 000000014007EC3B
htons.WS2_32 ref: 000000014007EC60
inet_pton.WS2_32 ref: 000000014007ECA2
connect.WS2_32 ref: 000000014007ECBC
closesocket.WS2_32 ref: 000000014007ECDB
WSACleanup.WS2_32 ref: 000000014007ECE1

Strings

system, xrefs: 000000014007EB8A
geo, xrefs: 000000014007EBCB

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: f4e87fcd7956cbe3016ebbdf261cfb37972362d5bb75c3155be231a23d4669a3
Instruction ID: a025bd78097a622ce99f6dd631d164278a997d1e4bf617748a8d7ff18237b3ae
Opcode Fuzzy Hash: f4e87fcd7956cbe3016ebbdf261cfb37972362d5bb75c3155be231a23d4669a3
Instruction Fuzzy Hash: BEB18D72B11A8095FB02DBB6D4803DC33B2AB9DB98F415216EB5927BF9DE38C546C340

Function 000000014009F1EC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009F619

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9071ed9fea90e513551440adfc0d466023ce052b27686926662429a076c20654
Instruction ID: 89a76c2e7bd64f2e292d0171c67a85ad1a22fb2b88445312a06a55af962eb3af
Opcode Fuzzy Hash: 9071ed9fea90e513551440adfc0d466023ce052b27686926662429a076c20654
Instruction Fuzzy Hash: 2EC1F372218B8192EB629F57A4403FE7BA4F799BD4F594111FB4A077B1CFB8C8859700

Function 000000014007D940 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000000014007D983
EnterCriticalSection.KERNEL32 ref: 000000014007D995
EnterCriticalSection.KERNEL32 ref: 000000014007D9A5
GdiplusShutdown.GDIPLUS ref: 000000014007D9B3
LeaveCriticalSection.KERNEL32 ref: 000000014007D9C0
LeaveCriticalSection.KERNEL32 ref: 000000014007D9CA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 311328e0c1a3d6f09e9d2e4e36d225c093cfd7f693314f7d25c72e43ed53fafa
Instruction ID: ccad471ceb86da12b8052557114d3172f4fe174a1baea1f974d0ccb94854474a
Opcode Fuzzy Hash: 311328e0c1a3d6f09e9d2e4e36d225c093cfd7f693314f7d25c72e43ed53fafa
Instruction Fuzzy Hash: 19112532511B5091EB169F26E84039D73B4FB48FA8F288216AB6E076B4CF39C897C350

Function 0000000140083890 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0000000140083A6C
recv.WS2_32 ref: 0000000140083F4C
closesocket.WS2_32 ref: 0000000140083F5E
WSACleanup.WS2_32 ref: 0000000140083F64

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: e3529e4f086e916588a050fb794958e2ac0093eb24aceede0b4d9dbc2b460c77
Instruction ID: 2da43283a9dc6e515e407d9e93031c35698a04021dc8004dc304920df4a58cdd
Opcode Fuzzy Hash: e3529e4f086e916588a050fb794958e2ac0093eb24aceede0b4d9dbc2b460c77
Instruction Fuzzy Hash: 6E128D73618BC481EA229B26E4443DEA761F7DD7D0F505216EBAD47AEADF78C580CB00

Function 000000014007E710 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014007E74B
OpenProcessToken.ADVAPI32 ref: 000000014007E75E
GetTokenInformation.ADVAPI32 ref: 000000014007E79A
CloseHandle.KERNEL32 ref: 000000014007E7BB

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 90ae23b39752d8e562d256ccd9c16a94bf4e7d6f39fa52c22aeb40f361b48fa7
Instruction ID: b5218933ea7703c7e048df4ba95b441abb8dda8107fd4ab30233c47b2b803c5e
Opcode Fuzzy Hash: 90ae23b39752d8e562d256ccd9c16a94bf4e7d6f39fa52c22aeb40f361b48fa7
Instruction Fuzzy Hash: 5211FB72219B8082E7519F16F84038AB7A0FB8DB80F559125FB9947B68CF3CC455CB40

Function 00000001400852C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 0000000140085329

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000000014008531B
ProductName, xrefs: 0000000140085314

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 45beb6f7e78784f3d9509a1d3ea3717a7d34e9a73ec6a4c6398bfce9d8be6136
Instruction ID: 0923dad602657fcfdd4189dd7accdda6bd0898d30bf99b6bbaeadf04a2d916fd
Opcode Fuzzy Hash: 45beb6f7e78784f3d9509a1d3ea3717a7d34e9a73ec6a4c6398bfce9d8be6136
Instruction Fuzzy Hash: 55115E32208B8082EB219F22F4413DAB3A4F79DB88F904215EB9C47B69DFBCC155CB40

Function 0000000140083C17 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0000000140083F4C
closesocket.WS2_32 ref: 0000000140083F5E
WSACleanup.WS2_32 ref: 0000000140083F64

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: 95e3429f520675f56c4b97f154f99d7dc85828c673adf1d39d37ca96e1e6d654
Instruction ID: 7db60b0abc5ae50f8d1ed737cd1e66b44ba841ec5a06357c0ac7b1b80de7ea70
Opcode Fuzzy Hash: 95e3429f520675f56c4b97f154f99d7dc85828c673adf1d39d37ca96e1e6d654
Instruction Fuzzy Hash: 989150B3A14BC481EA228B26E4443DE6761F7D97E0F505315EBAD07AEADF78C581C700

Function 0000000140085FB1 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140085FC9
RegEnumKeyExA.ADVAPI32 ref: 000000014008600E
RegCloseKey.ADVAPI32 ref: 0000000140086204

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: fa56d9e272c57ab1efd7a57ecb14589b071b14ab9fb351ea4e3d4cd9b7db20a5
Instruction ID: 3126900138017e27c26b7e97fdf396bcda76f2f26d0a694c5074764b3548d2ce
Opcode Fuzzy Hash: fa56d9e272c57ab1efd7a57ecb14589b071b14ab9fb351ea4e3d4cd9b7db20a5
Instruction Fuzzy Hash: DF716C73A04B8486EB11CB66E44479E7761F7897E8F104616FBA917AEADF78C1C1C700

Function 0000000140085F40 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140085FC9
RegEnumKeyExA.ADVAPI32 ref: 000000014008600E

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: 6550f83a76ef02cb639577a8c322407ba9ca0699da3057204f7e0e5f7f356cfe
Instruction ID: d7a65414a419a411271327cc786576db46dcb625295add4502772783f8e551d9
Opcode Fuzzy Hash: 6550f83a76ef02cb639577a8c322407ba9ca0699da3057204f7e0e5f7f356cfe
Instruction Fuzzy Hash: CB319C32600B8086EB218BA2E854B9E77A4F7497D8F200615EF9917B65DF38C192C700

Function 00000001400ACB04 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000001400ACB1D
FreeEnvironmentStringsW.KERNEL32 ref: 00000001400ACB8F

Part of subcall function 000000014009D17C: HeapAlloc.KERNEL32 ref: 000000014009D1BA

FreeEnvironmentStringsW.KERNEL32 ref: 00000001400ACBEE

Part of subcall function 000000014009BC88: HeapFree.KERNEL32 ref: 000000014009BC9E
Part of subcall function 000000014009BC88: GetLastError.KERNEL32 ref: 000000014009BCA8

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
String ID:
API String ID: 3331406755-0
Opcode ID: c15c1da211f12da5ddd943b450918cac83ffbfeee98227f293861ad03f8cb8af
Instruction ID: 258d45838a42909b4d495c2cc59036331f00c14b156d323c19056bd3fcf00d93
Opcode Fuzzy Hash: c15c1da211f12da5ddd943b450918cac83ffbfeee98227f293861ad03f8cb8af
Instruction Fuzzy Hash: F831B13122478081EA269F2768417EA76A4B79CFD4F494319BB4A57BE5DF39C4818B00

Function 0000000140085C7B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140085C97
RegQueryValueExA.ADVAPI32 ref: 0000000140085CD6
RegCloseKey.ADVAPI32 ref: 0000000140085D74

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 98a3e54482a17532a660a8fa1cab900c309b5f6fda42c005ceacfcf74f8e1bea
Instruction ID: 3f4b0842e8fc82fdf074bf0f3e32c2781c2fe54cfa2cd97e6c43f32abcda0346
Opcode Fuzzy Hash: 98a3e54482a17532a660a8fa1cab900c309b5f6fda42c005ceacfcf74f8e1bea
Instruction Fuzzy Hash: AD218173614B8481EA619B26E49439EA760FBDD7D4F505212FB8E47AB9EE3CC185CB00

Function 0000000140084730 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 0000000140084757
GetGeoInfoA.KERNEL32 ref: 0000000140084771
GetGeoInfoA.KERNEL32 ref: 00000001400847C1

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 09ae55b4e622fe248be01bc66097043d67a2342efe4101a7f522a741858beff8
Instruction ID: 0da6c51708aae802c1c715e5ab97e643279c3131667dc25065de9ec91bfb8954
Opcode Fuzzy Hash: 09ae55b4e622fe248be01bc66097043d67a2342efe4101a7f522a741858beff8
Instruction Fuzzy Hash: 3811BF32A1878183D7118F62F41479EB3A2FB84FC8F445125EB8503B69DF7CD5908B84

Function 00000001400A3820 Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400A3831
TerminateProcess.KERNEL32 ref: 00000001400A383C
ExitProcess.KERNEL32 ref: 00000001400A384B

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8894e589db04ddd2d14810d04fdd379fe1a67dc706d1f09feb04222f201663c3
Instruction ID: 2ea921b5de8585c7ead1c9c47d07aa2049e2c11de3f04c0e1d401d775a7a3a6d
Opcode Fuzzy Hash: 8894e589db04ddd2d14810d04fdd379fe1a67dc706d1f09feb04222f201663c3
Instruction Fuzzy Hash: 84D0923870070693EB1A6B7268963EC52266F6DBC1F14292CBA03073B3CE3D888E4611

Function 0000000140040E70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014004105C

Strings

, xrefs: 0000000140040EF3

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: b97fa85fd6d080112689539a1df79cb63ca38774697952c274d3f990b54ca2e5
Instruction ID: 4a1abb7f16d831aa52622629eddc64690d6838a0f628c8f588688f42a2f75156
Opcode Fuzzy Hash: b97fa85fd6d080112689539a1df79cb63ca38774697952c274d3f990b54ca2e5
Instruction Fuzzy Hash: 93515572304B8496EB268F2AD19439C33A0F388BD4F954622EF5D53BA5CF79D4A6C304

Function 0000000140085AD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 0000000140085B0C

Strings

Unknown, xrefs: 0000000140085BC6

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 370ad8d10583bea3bf14cf6bd73c985662e30a083e550bf09a4d6a2d7c1b6686
Instruction ID: fc0f38fc8322fcab52c5dd085439699fc5d39dddd363d65fb3ed261f826ffc69
Opcode Fuzzy Hash: 370ad8d10583bea3bf14cf6bd73c985662e30a083e550bf09a4d6a2d7c1b6686
Instruction Fuzzy Hash: 8A31CD33628BC086E711CF22E4403DAB760F7A9B84F545215FBCA17A6ADB7CC695CB00

Function 00000001400474A0 Relevance: 3.2, APIs: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400475E0
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400476DF

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 7b4fe20866bdcc0bac301f3d6566340bd892cf834fe267d167d240e53d73b122
Instruction ID: 71a22894ff747ab8b3437f2b7930de81b013a1e249af08e6b7946cdfb5fda7e0
Opcode Fuzzy Hash: 7b4fe20866bdcc0bac301f3d6566340bd892cf834fe267d167d240e53d73b122
Instruction Fuzzy Hash: BB5106B2301B4095EE269F27A5007E96256E74CBE4F590631FF6D0B7F6EE78C4818304

Function 000000014007DDC0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000000014007DE19
CoTaskMemFree.OLE32 ref: 000000014007DEDA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 802f0dca9c775e43cdb46f403647510168036d8998da0434065c44830da239a0
Instruction ID: 55715e2a66dfc52912f6fef3d118ca5409f61bb99c4b7665450f664eadaf1565
Opcode Fuzzy Hash: 802f0dca9c775e43cdb46f403647510168036d8998da0434065c44830da239a0
Instruction Fuzzy Hash: BE316672A14B8081E621CF26E44139EB761F79D7F4F105316FBAD47AA9DB7CC1818B40

Function 0000000140092F08 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140092F2F

Part of subcall function 0000000140092EC4: _invalid_parameter_noinfo.LIBCMT ref: 0000000140092EDB

_invalid_parameter_noinfo.LIBCMT ref: 0000000140092FE3

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 634ca63b1299db0c69c46a9c87062dc1bde1b4139033e41e1825c3da2e6d69db
Instruction ID: d670c74a3cad8dea1a861d3376d60556d5dbf12abfbe617c3eb3189632f6d3bf
Opcode Fuzzy Hash: 634ca63b1299db0c69c46a9c87062dc1bde1b4139033e41e1825c3da2e6d69db
Instruction Fuzzy Hash: BB31DD72210A4481EE56EB56E8613E963A0E79CBC0F940631F75E473F2EB38C545CB00

Function 000000014007C400 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007C451
RegCloseKey.ADVAPI32 ref: 000000014007C463

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: e2db2b8549d09c46c0c409d88c472a4204a4d469fc154098e38cf9eddf7af88f
Instruction ID: 33e98342e1dbc51f3766f630471af370cdcb195a6e8e0b13f4e2b894d56ac143
Opcode Fuzzy Hash: e2db2b8549d09c46c0c409d88c472a4204a4d469fc154098e38cf9eddf7af88f
Instruction Fuzzy Hash: C221A332725A8045EE519B23E8507EAA760FB9DFD4F495125FB4E43BA9DF3CC4818700

Function 000000014007B6CC Relevance: 3.1, APIs: 2, Instructions: 57synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003D680: CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003D6CA
Part of subcall function 000000014003D680: Process32FirstW.KERNEL32 ref: 000000014003D70C

Part of subcall function 000000014003BA80: CredEnumerateA.ADVAPI32 ref: 000000014003BAE2

Part of subcall function 0000000140083890: recv.WS2_32 ref: 0000000140083A6C

ReleaseMutex.KERNEL32 ref: 000000014007B736
CloseHandle.KERNEL32 ref: 000000014007B73F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 8b8447a8b915974071f3a08b26181bd4282b7d5f4d27517d31bd520b905839d0
Instruction ID: f10cd317d46a8061a63238d510a0afd0e99a1dcd5fca171a1b6c180d916f7be3
Opcode Fuzzy Hash: 8b8447a8b915974071f3a08b26181bd4282b7d5f4d27517d31bd520b905839d0
Instruction Fuzzy Hash: 3C218C7160868141FA27B7B7A4563EE6340AFCE7D0F145A21FB9A436F7DE3CC0809622

Function 00000001400AD888 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00000001400AD89F
_RTC_Initialize.LIBCMT ref: 00000001400AD8C0

Part of subcall function 00000001400BC3C8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BC3FA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 9f55e90913658458d0baa701b2b7b8f387f595ce9a8c9f74acf3b7ee8b8922bb
Instruction ID: bf1a4c9bad61c6cf295336fbe84c7c5893434da79de8b2b3da9e20f25465f2a6
Opcode Fuzzy Hash: 9f55e90913658458d0baa701b2b7b8f387f595ce9a8c9f74acf3b7ee8b8922bb
Instruction Fuzzy Hash: 0211A23466024142FE177BF3445B7ED31954BBD3C0F441A29B756972F3EEB889814AA2

Function 000000014007B6FD Relevance: 3.0, APIs: 2, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140083890: recv.WS2_32 ref: 0000000140083A6C

ReleaseMutex.KERNEL32 ref: 000000014007B736
CloseHandle.KERNEL32 ref: 000000014007B73F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 795b393336643d9005e1441f54a42898eca0ffb56d6f142cab5f3b3c29d99d1b
Instruction ID: 7c7df572d18e132df0cc7954c78060e49782440cc91fd5e23d273308c34aa20c
Opcode Fuzzy Hash: 795b393336643d9005e1441f54a42898eca0ffb56d6f142cab5f3b3c29d99d1b
Instruction Fuzzy Hash: 24116D7261868141FA67B777A4163EE6350AFCEBD0F145221BB99076F7DE3CC080C611

Function 000000014009F75C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000000014009F7A8
GetLastError.KERNEL32 ref: 000000014009F7B2

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bf64b2ca6c828aa2865472cbc32df9119e6dc20bcb509235e4a2de8cfbd7474d
Instruction ID: 46564ee9d56e3c7b5ba1a1fab28bafcdd2752c4fc38c25dfd0f57ce0032245ed
Opcode Fuzzy Hash: bf64b2ca6c828aa2865472cbc32df9119e6dc20bcb509235e4a2de8cfbd7474d
Instruction Fuzzy Hash: 4711A076318B8081EA218B26A4443A9A761E798FF4F644312FF794B7F9DF78C0918740

Function 000000014007B724 Relevance: 3.0, APIs: 2, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 000000014007B736
CloseHandle.KERNEL32 ref: 000000014007B73F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexRelease
String ID:
API String ID: 4207627910-0
Opcode ID: 9c337312b80d2d38a3baa7b6c66967634573851b1351c332d2a925c877b67f73
Instruction ID: 534bebf3c5aab0f9e7bb800e237f7db9ba722c6094160e883dbefabcf6144a52
Opcode Fuzzy Hash: 9c337312b80d2d38a3baa7b6c66967634573851b1351c332d2a925c877b67f73
Instruction Fuzzy Hash: FC018F72A086C142FA66AB3BE4153DD6350ABCDBE1F145311BB9A076F6EF3CC081C600

Function 00000001400AD148 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400AD178

Part of subcall function 00000001400AE19C: std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400AE1A5

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400AD17E

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ba3aa8670788eabeaf193c5d6875b73550c8a9037df0e5da198d367d2e00ed63
Instruction ID: 8a138c7820b728ff1b6e361a71ad5426c6f0f74126902d65813b18e6a5a28ee9
Opcode Fuzzy Hash: ba3aa8670788eabeaf193c5d6875b73550c8a9037df0e5da198d367d2e00ed63
Instruction Fuzzy Hash: 21E0127061110555FD2B267318153F520401F6D7F0F1C1B217FB6076F3A978C4D18D10

Function 000000014009BC88 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014009BC9E
GetLastError.KERNEL32 ref: 000000014009BCA8

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 394618f50db7fbbd1fef49d22478318aab263d5d118c1dceebe5262d95cd9652
Instruction ID: 0b5330ced0e29f78a79284f3cf9380b093bbeb4d8d894d7985c437e0057f45df
Opcode Fuzzy Hash: 394618f50db7fbbd1fef49d22478318aab263d5d118c1dceebe5262d95cd9652
Instruction Fuzzy Hash: 0BE017F5B0160162FF1BA7F3A8563EA12915FACBD0F048420BB19932B2EE3888958610

Function 000000014008DAF0 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014008DD40

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b4170ca246f7b06beccc7ac9e070f92329930d084c876b8179c86b6049eff60d
Instruction ID: d0d4a9a4096f2515e684ff415137a2abc53100603a9f39e4ea57f913a362a5d5
Opcode Fuzzy Hash: b4170ca246f7b06beccc7ac9e070f92329930d084c876b8179c86b6049eff60d
Instruction Fuzzy Hash: E2616873301A8485EA169E17D1543AD37A2F349FD8F558622EF6E0B3E5DB78CA86D300

Function 000000014002E2A0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000000014002E3D3

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 4ad4d258e8038ebb62c4665b52b0a199e7f30c3b6c0de5d0078ad3618b3c21bd
Instruction ID: cf3e95423c2b5032186d8df5afcb552741feadb5e4544773b76807159a3cd90b
Opcode Fuzzy Hash: 4ad4d258e8038ebb62c4665b52b0a199e7f30c3b6c0de5d0078ad3618b3c21bd
Instruction Fuzzy Hash: 0E61C472B40A8096FB12DF7AD4903ED23A1E74D7E8F40462AFF1957BE5EA34C9918300

Function 0000000140047D80 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140047F15

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 03ce9d0e3375c82842fa70db0fb78aa8d24b2234106e7cf032a5740499f0bb4c
Instruction ID: e4b19214cd8291f7c2a3f7ba8663091feaa898583f7ef6e0799addca7407a7b1
Opcode Fuzzy Hash: 03ce9d0e3375c82842fa70db0fb78aa8d24b2234106e7cf032a5740499f0bb4c
Instruction Fuzzy Hash: 7141BC72304A8481EA229F27E5443ED6365F74DBD4F580A35EFAD0B7A6DF38C8418304

Function 0000000140047F30 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400480AC

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 91c1d0024a4ceec18961aef921753dc9ec11f4d7a9d20682904b5b8028ae8ee7
Instruction ID: 14160285011a48e7f41132f3120126f3728569180f830c231f43946f66594cc4
Opcode Fuzzy Hash: 91c1d0024a4ceec18961aef921753dc9ec11f4d7a9d20682904b5b8028ae8ee7
Instruction Fuzzy Hash: 0D41D172310B4485EE62AB17A5043EDA251B34CFD4F584A32BF6D0B7E6DE78C585D308

Function 00000001400435C0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140043711

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2d18077927b17f92ad3f211cd267c921e024e86c666159b974f6e55435282a48
Instruction ID: 03247c937121448092883c269b88bee03c0d05a80159fb3526169df5d674918d
Opcode Fuzzy Hash: 2d18077927b17f92ad3f211cd267c921e024e86c666159b974f6e55435282a48
Instruction Fuzzy Hash: 0831D2B2301A8554FE26AB57E5403E926919709FE4F565231EF2D07BE6EE78C481C344

Function 000000014009C188 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009C1B0

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 281f6fd9153be7f1626fe0826c31dc4fe947b8601093dfe6e86b2fa98026100a
Instruction ID: d81f1f3b013fd9dff1d6c6ed14603e01849b91a5f7cc6777860c49fb60551185
Opcode Fuzzy Hash: 281f6fd9153be7f1626fe0826c31dc4fe947b8601093dfe6e86b2fa98026100a
Instruction Fuzzy Hash: B041D1B262064087EA768B5AE5507E973A4F75ABD0F141205FB8A877F1CB38D803CB51

Function 00000001400850F0 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000140085180

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 8c851119c1025d19680f206ef99bf1d565e4006ab44c0d104981a73e61e7a8bc
Instruction ID: 3e4f4deb163ecf7065a35b7f87b05c89be95e7df2a8154597d23eeef62723db6
Opcode Fuzzy Hash: 8c851119c1025d19680f206ef99bf1d565e4006ab44c0d104981a73e61e7a8bc
Instruction Fuzzy Hash: C9518E33A14B8089E712CF79E8443DD7760F799788F504212EB8C57AA9DF78C684CB40

Function 0000000140041970 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140041A78

Part of subcall function 000000014002B820: __std_exception_copy.LIBVCRUNTIME ref: 000000014002B868

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: b2d8e5f1be8f2f8d542de75146d83861674ac033b6a07a4ff179556af76ea083
Instruction ID: a8f0adb98431b775425e9ead8c3c05668da373c0a0ccb6e90c9b6137a0fdfd0e
Opcode Fuzzy Hash: b2d8e5f1be8f2f8d542de75146d83861674ac033b6a07a4ff179556af76ea083
Instruction Fuzzy Hash: 0121E972702B5441EA1AAB56E1403E86290E788BE4F254731EB7C07BE5EE78C9E29340

Function 000000014009F0CC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009F152

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b4453dcf53b1a406caf81c0f7e08a99bf745a785fcbd5ce79fe073e0462c5a7f
Instruction ID: 039b51f25f9133a0960bb8f5086f042a09a8f8d88124adaea2b7abbcf7265592
Opcode Fuzzy Hash: b4453dcf53b1a406caf81c0f7e08a99bf745a785fcbd5ce79fe073e0462c5a7f
Instruction Fuzzy Hash: 8131E3B2614640D6F727AFA7D8413ED6B90A748BE4F810205FB65433F2DBB8C8829B51

Function 00000001400A3751 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400A377F

Part of subcall function 00000001400A3878: GetModuleHandleExW.KERNEL32 ref: 00000001400A389D
Part of subcall function 00000001400A3878: GetProcAddress.KERNEL32 ref: 00000001400A38B3
Part of subcall function 00000001400A3878: FreeLibrary.KERNEL32 ref: 00000001400A38DA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9a4319b1a9349b175a2ab261d3967c41928b3e2b203d956efbe5c9eb3dbfe620
Instruction ID: 1fc59b4a59ae85b46f6b9166bdbff0bb4c7d0c063c157e92636b79c63da886d1
Opcode Fuzzy Hash: 9a4319b1a9349b175a2ab261d3967c41928b3e2b203d956efbe5c9eb3dbfe620
Instruction Fuzzy Hash: 84214AB6A00B848EEB268F65C8443EC37B0E758758F545B2AF72947AE5DF38C585CB40

Function 00000001400BE7B8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BE7DB

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d348ac23900305c462c0690c0df5af421cd1f821f12a258e8e5c958353d8cc37
Instruction ID: 963f332baa30f0764726ce0e89d6d1f8c441babd3b41037a9d74ad3d40288263
Opcode Fuzzy Hash: d348ac23900305c462c0690c0df5af421cd1f821f12a258e8e5c958353d8cc37
Instruction Fuzzy Hash: F6219672214EC087DB669F6AE4403A977B1E788BD4F644224F75D4B6F5DB39C8008B00

Function 00000001400BCAC0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BCA1D

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction ID: 76031a156d145f1e75ff053a72b768cc5537241a87ef5f05dfead53edc72914a
Opcode Fuzzy Hash: 277766cc613ac521deff1262cc5973a4c6dda0ce244441028124d0478fb53980
Instruction Fuzzy Hash: 11119631224A4481FA62DF9394107EEA3B4F78DBC8F444421FB94577B6DB7DC8418B52

Function 000000014007FC60 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000000014007FCA8

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 7b014de7d978259952d8fbf9b19179fb3552117fbf4d6986a0cc05869dadf4b1
Instruction ID: ed63c22e22b379f3c336386ece21b3ad8a2337843b1b8e3a89cebf0bef14ddfa
Opcode Fuzzy Hash: 7b014de7d978259952d8fbf9b19179fb3552117fbf4d6986a0cc05869dadf4b1
Instruction Fuzzy Hash: DE016D36718A8881EB518F2BBA4076AA7A0F78CFD4F589135EF9D43B58DA38C8418740

Function 0000000140095C34 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140095C53

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction ID: 12817fefe43cbe0e35e8e44782809c7bb200d723c329c7900ab39acf6a87230c
Opcode Fuzzy Hash: 68ea0e6e30933e9dd76abf56f21314c638998a57c534cc3687c594a1fb5b02e7
Instruction Fuzzy Hash: 8BE092B121674085EF267BBBA1813AD65509B0C7F0F548321B774076F6DB74C8604B01

Function 00000001400B9D78 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400B9D7C

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 05abf0131c8b098d1a61f2295ae7c7f0a4315664c5cc964735d2d131e1c6be8e
Instruction ID: d77e7af20007b7e33648d6574d0470e4b7856eca6e046ac06dd638d9c475ad65
Opcode Fuzzy Hash: 05abf0131c8b098d1a61f2295ae7c7f0a4315664c5cc964735d2d131e1c6be8e
Instruction Fuzzy Hash: 16C09238F16902D2E65A2FB75CC338A12E0AB9C780F844020E304822B1DA3C81E7CB31

Function 00000001400BB974 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000001400BB97D

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: a58d1d1940ea9a1276aa9ae53fd9a4567027d1a2ff5bbf1696185df6648e20bf
Instruction ID: 2d4ebf22e8ea44c3de85ce703a090383597d96474293fc5e484319a26ec3cfd3
Opcode Fuzzy Hash: a58d1d1940ea9a1276aa9ae53fd9a4567027d1a2ff5bbf1696185df6648e20bf
Instruction Fuzzy Hash: 2AB09236A148C0E7C612EB04E8422497331FB98B18FD00000E38943624CF2CDA2A8E10

Function 000000014009C2F0 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009C345

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 53d8e6fe3df60df409aa1b30b1f8cca8e9b674a67e9b362d6300d0fc87b1227c
Instruction ID: 0ee19f60c367baada821e95bfc14ea9fe8802c50f1a7eb9f1d246396595a9061
Opcode Fuzzy Hash: 53d8e6fe3df60df409aa1b30b1f8cca8e9b674a67e9b362d6300d0fc87b1227c
Instruction Fuzzy Hash: 04F067B4B2124081FE6A57A3A9447E912842B8CBC0F4CD4307F1E873F2DE3CCA848220

Function 000000014009D17C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009D1BA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: e225fa2b0dbec660310bef0d9b6d64f65c59680a2a45183e3c4b35eee9a22bf5
Instruction ID: 02b13d49a3f81dd7a96231731d72b5532a686b3fe38c3284392ef13d9092b2b0
Opcode Fuzzy Hash: e225fa2b0dbec660310bef0d9b6d64f65c59680a2a45183e3c4b35eee9a22bf5
Instruction Fuzzy Hash: C8F0377A39524456FE675BB368113E962905B4C7E0F4857217F26873F1DE7CC441C610

Non-executed Functions

Function 0000000140088FE0 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 0000000140089023
NtAllocateVirtualMemory.NTDLL ref: 000000014008905B
lstrcpyW.KERNEL32 ref: 00000001400890BD
lstrcatW.KERNEL32 ref: 0000000140089172
NtAllocateVirtualMemory.NTDLL ref: 00000001400891F9
lstrcpyW.KERNEL32 ref: 00000001400892AC
RtlInitUnicodeString.NTDLL ref: 00000001400892C1
RtlInitUnicodeString.NTDLL ref: 00000001400892D6
LdrEnumerateLoadedModules.NTDLL ref: 00000001400892E9
RtlReleasePebLock.NTDLL ref: 00000001400892EF

Part of subcall function 000000014007DDC0: SHGetKnownFolderPath.SHELL32 ref: 000000014007DE19
Part of subcall function 000000014007DDC0: CoTaskMemFree.OLE32 ref: 000000014007DEDA

CoInitializeEx.OLE32 ref: 000000014008939A
lstrcpyW.KERNEL32 ref: 0000000140089579
lstrcatW.KERNEL32 ref: 000000014008977E
CoGetObject.OLE32 ref: 000000014008979C
lstrcpyW.KERNEL32 ref: 0000000140089E19
lstrcatW.KERNEL32 ref: 000000014008A03C
CoGetObject.OLE32 ref: 000000014008A05A
CoUninitialize.OLE32 ref: 000000014008A522

Strings

0, xrefs: 0000000140089C5A

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: f9a4b21bba6b5778666b90edc385f803ff7b984533bf3915daa45dc885927a08
Instruction ID: e604d7167b34311c8e0fe99e090bcd918b4f7d2940aac51addfe585592677c6d
Opcode Fuzzy Hash: f9a4b21bba6b5778666b90edc385f803ff7b984533bf3915daa45dc885927a08
Instruction Fuzzy Hash: F8C2B836626F988AD7908F69E88169EB3B5F788B88F105215FFCD57B18EB38C154C740

Function 00000001400B9E68 Relevance: 27.2, APIs: 18, Instructions: 229fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400B9F15
GetLastError.KERNEL32 ref: 00000001400B9F1F
FindFirstFileW.KERNEL32 ref: 00000001400B9F36
GetLastError.KERNEL32 ref: 00000001400B9F42
FindClose.KERNEL32 ref: 00000001400B9F50
__std_fs_open_handle.LIBCPMT ref: 00000001400B9FE3
CloseHandle.KERNEL32 ref: 00000001400B9FF9
CloseHandle.KERNEL32 ref: 00000001400BA16C

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 49566460a907a601e1f093275e7cedc738230c471b32bdcbe51d950a59750163
Instruction ID: bd0a7feb077c907354969762849b34151d67fe78fda9ec3b2a3bd20647f569a0
Opcode Fuzzy Hash: 49566460a907a601e1f093275e7cedc738230c471b32bdcbe51d950a59750163
Instruction Fuzzy Hash: 42914131310E0146EAB69FABA8547EA62A0AB9E7F4F144714FB76477F4DB3CC8458710

Function 00000001400888E0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140088926
GetProcAddress.KERNEL32 ref: 0000000140088936
OpenProcess.KERNEL32 ref: 0000000140088968
NtQuerySystemInformation.NTDLL ref: 0000000140088990
NtQuerySystemInformation.NTDLL ref: 00000001400889BE
GetCurrentProcess.KERNEL32 ref: 0000000140088A83
NtQueryObject.NTDLL ref: 0000000140088AC9
GetFinalPathNameByHandleA.KERNEL32 ref: 0000000140088BBD
CloseHandle.KERNEL32 ref: 0000000140088CD8
CloseHandle.KERNEL32 ref: 0000000140088D68

Strings

ntdll.dll, xrefs: 000000014008891F
NtDuplicateObject, xrefs: 000000014008892F
File, xrefs: 0000000140088AFA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: bf9a0ccce2cd6c5d3e29f71ce3efbea8b02204595c9946da31666db7e6f30529
Instruction ID: 88f1b79f6286c0e5e0663165defaf3d7e800104a22575653cc64f1d0f6badeec
Opcode Fuzzy Hash: bf9a0ccce2cd6c5d3e29f71ce3efbea8b02204595c9946da31666db7e6f30529
Instruction Fuzzy Hash: 60E19D73B14A8089FB12DBA6D4143ED23A1F759BD8F408521EF5D57BA9DE38C64A8300

Function 0000000140073C40 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 0000000140073C9F

Strings

@, xrefs: 0000000140073E26

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: @
API String ID: 2538663250-2766056989
Opcode ID: f2b88f0e31e157c8ed3a7a2a778d31259d4e7010baddb37256c0379137fda1c2
Instruction ID: 316128c581b16c4d3f4b3da09d2500f057a97763de5d99de1d399ef9cdafa0b3
Opcode Fuzzy Hash: f2b88f0e31e157c8ed3a7a2a778d31259d4e7010baddb37256c0379137fda1c2
Instruction Fuzzy Hash: C6A14872B04A808AF722CF76E41479D7771B78CB98F104225EF9A17AA8EB39C555C384

Function 000000014007A320 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 000000014007A8A7

Strings

ios_base::badbit set, xrefs: 000000014007AABA
ios_base::eofbit set, xrefs: 000000014007AACC
.cmd, xrefs: 000000014007A3E3
open, xrefs: 000000014007A81D
ios_base::failbit set, xrefs: 000000014007AAC5
.exe, xrefs: 000000014007A46D
.ps1, xrefs: 000000014007A3B4
runas, xrefs: 000000014007A826
.exe, xrefs: 000000014007A385
.vbs, xrefs: 000000014007A412
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 000000014007A4B4

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: dac6a84f89353b7f1c07caf956257581d7611a8d53d37b6a460d21ae5b7b81ea
Instruction ID: 1c4fe17788cb8f09727e1eb0c249120cc654e615ca3ad5b5903190ad2158ec18
Opcode Fuzzy Hash: dac6a84f89353b7f1c07caf956257581d7611a8d53d37b6a460d21ae5b7b81ea
Instruction Fuzzy Hash: 78229D72A10B8099EB11DF3AE8843DD77A1F789798F505216FB5D07AA9EF78C584C700

Function 0000000140077340 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00000001400773D8
BCryptSetProperty.BCRYPT ref: 0000000140077402
BCryptGenerateSymmetricKey.BCRYPT ref: 000000014007743B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140077561

Strings

AES, xrefs: 00000001400773CD
ChainingModeGCM, xrefs: 00000001400773F0
ChainingMode, xrefs: 00000001400773F7

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmConcurrency::cancel_current_taskGenerateOpenPropertyProviderSymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 2222192889-1213888626
Opcode ID: 9a1a3cd6e6ddd17ddf90823c6e7be3f2930cf914a1463a096f49e54039a43834
Instruction ID: 8d1d121c70002e2b68f3aba67cbb1f4ecb0d904613cd8cca5b9a22352f8360ed
Opcode Fuzzy Hash: 9a1a3cd6e6ddd17ddf90823c6e7be3f2930cf914a1463a096f49e54039a43834
Instruction Fuzzy Hash: B061D472700B8482EB269B66E8407E96760E78DBE8F544725BF6C07BF6DB78C5918300

Function 00007FF60807CAF1 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 258fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF60807CBEE
FindNextFileW.KERNEL32 ref: 00007FF60807CC77
FindClose.KERNEL32 ref: 00007FF60807CCB4
FindClose.KERNEL32 ref: 00007FF60807CCF2

Strings

., xrefs: 00007FF60807CC35
*, xrefs: 00007FF60807CB1E

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID: *$.
API String ID: 1164774033-3886413389
Opcode ID: 1ad28d0ae4af48d40e9119588df1c5008e8f9d7b3627aa4813c3e566a8eb1879
Instruction ID: d46f0d5f103ba7df798cb1923e7bb503d6be6a43a0b6d622eb48483e2993feec
Opcode Fuzzy Hash: 1ad28d0ae4af48d40e9119588df1c5008e8f9d7b3627aa4813c3e566a8eb1879
Instruction Fuzzy Hash: 23A1D422F1869641FA60DB35E4042B96390EB85BE4F645132EE5F9BBC9DF3CE941830C

Function 00000001400A74C4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400987AC: GetLastError.KERNEL32 ref: 00000001400987BB
Part of subcall function 00000001400987AC: FlsGetValue.KERNEL32 ref: 00000001400987D0
Part of subcall function 00000001400987AC: SetLastError.KERNEL32 ref: 000000014009885B

TranslateName.LIBCMT ref: 00000001400A752E
TranslateName.LIBCMT ref: 00000001400A7569
GetACP.KERNEL32 ref: 00000001400A75B0
IsValidCodePage.KERNEL32 ref: 00000001400A75E8
GetLocaleInfoW.KERNEL32 ref: 00000001400A77A5

Strings

utf8, xrefs: 00000001400A76CC

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: b6b5f0871776deda8e7c69fea737524f09f83080a3327ccb47b1bd94534ebeda
Instruction ID: d5ac7b476c8a9bce444684ebd37fc73749f6f001cbd1fa0b2ab8da16a1f6a6e0
Opcode Fuzzy Hash: b6b5f0871776deda8e7c69fea737524f09f83080a3327ccb47b1bd94534ebeda
Instruction Fuzzy Hash: 74918E36700B4081EB669F23D941BED63A4E7ACBC0F448221EF4D477A6EB78C592CB50

Function 00000001400A7F0C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400987AC: GetLastError.KERNEL32 ref: 00000001400987BB
Part of subcall function 00000001400987AC: FlsGetValue.KERNEL32 ref: 00000001400987D0
Part of subcall function 00000001400987AC: SetLastError.KERNEL32 ref: 000000014009885B

Part of subcall function 00000001400987AC: FlsSetValue.KERNEL32 ref: 00000001400987F1

GetUserDefaultLCID.KERNEL32 ref: 00000001400A807C

Part of subcall function 00000001400987AC: FlsSetValue.KERNEL32 ref: 000000014009881E
Part of subcall function 00000001400987AC: FlsSetValue.KERNEL32 ref: 000000014009882F
Part of subcall function 00000001400987AC: FlsSetValue.KERNEL32 ref: 0000000140098840

EnumSystemLocalesW.KERNEL32 ref: 00000001400A8063
ProcessCodePage.LIBCMT ref: 00000001400A80A6
IsValidCodePage.KERNEL32 ref: 00000001400A80B8
IsValidLocale.KERNEL32 ref: 00000001400A80CE
GetLocaleInfoW.KERNEL32 ref: 00000001400A812A
GetLocaleInfoW.KERNEL32 ref: 00000001400A8146

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: b1335ece248e5c8e3195e4a98367805ba8d0dabbc837c8d301c8a4141c46c529
Instruction ID: eff23689320ff5adc5df77f7c9cc30a6b599853c8a01bd4f4dfa4f293dad0dfa
Opcode Fuzzy Hash: b1335ece248e5c8e3195e4a98367805ba8d0dabbc837c8d301c8a4141c46c529
Instruction Fuzzy Hash: E6718E3270060099FB629B62D850BED33B4BB5CBC4F448625EF59577E5EB38C98ACB50

Function 00007FF6080754D4 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6080754F0
RtlCaptureContext.KERNEL32 ref: 00007FF60807551D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF608075537
RtlVirtualUnwind.KERNEL32 ref: 00007FF608075578
IsDebuggerPresent.KERNEL32 ref: 00007FF6080755CC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6080755E9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6080755F4

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 703016598f4b49543d9c9636df41fb7a299657f8bb96d1c8adaf98595dcbe2c0
Instruction ID: 38427a7c1a0420ddc728c653dc84aacbf0127b154fced3301eac4846174c2634
Opcode Fuzzy Hash: 703016598f4b49543d9c9636df41fb7a299657f8bb96d1c8adaf98595dcbe2c0
Instruction Fuzzy Hash: CE313C72A08B8286EB64CF70E8403EE7360FB84754F54443ADA4E87B95DF78D548C718

Function 00000001400ADB78 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000001400ADB94
RtlCaptureContext.KERNEL32 ref: 00000001400ADBC1
RtlLookupFunctionEntry.KERNEL32 ref: 00000001400ADBDB
RtlVirtualUnwind.KERNEL32 ref: 00000001400ADC1C
IsDebuggerPresent.KERNEL32 ref: 00000001400ADC70
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001400ADC8D
UnhandledExceptionFilter.KERNEL32 ref: 00000001400ADC98

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 3efb770cfb16d5d0ed57f42d694c11b3d6a4fbf3d96f685e31a20390ead54e25
Instruction ID: 9f7744655287aa887559b9cff32dfa778d51491bd1e8afa760c84834dbf292cd
Opcode Fuzzy Hash: 3efb770cfb16d5d0ed57f42d694c11b3d6a4fbf3d96f685e31a20390ead54e25
Instruction Fuzzy Hash: B0315072615B8086EB619F61E8403ED7374F798784F44452AEB4E47BA8DF78C649CB10

Function 000000014006F1C0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000000014006F374
__std_exception_destroy.LIBVCRUNTIME ref: 000000014006F382
__std_exception_destroy.LIBVCRUNTIME ref: 000000014006F605
__std_exception_destroy.LIBVCRUNTIME ref: 000000014006F613

Strings

value, xrefs: 000000014006F29A, 000000014006F533

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 82c3d6565131afdded86e4ebd0b109237adc3dcd0665d894327a522c76d62dca
Instruction ID: 4e7bf3bedcc79ae228617acf5de83c008c58e0c15488d6f1396da54890448ec7
Opcode Fuzzy Hash: 82c3d6565131afdded86e4ebd0b109237adc3dcd0665d894327a522c76d62dca
Instruction Fuzzy Hash: 18028E72614BC095EB02CB76D8803ED6761E79A7E4F605612FB9D43AEADF78C185C700

Function 00007FF608077760 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6080777D9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6080777F1
RtlVirtualUnwind.KERNEL32 ref: 00007FF60807782C
IsDebuggerPresent.KERNEL32 ref: 00007FF608077865
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF60807786F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF60807787A

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 84edda72ec9d520141983e74228c668a6a8178568ee7aa51ae599cd2c23f2f3d
Instruction ID: f99f1d95540be6d023456db5bd76f61420b4e64eb7db584c11a696d88b4b2f8f
Opcode Fuzzy Hash: 84edda72ec9d520141983e74228c668a6a8178568ee7aa51ae599cd2c23f2f3d
Instruction Fuzzy Hash: A9318632A08F8186EB64CF75E8402AE73A0FB88794F640135EA9D87B95DF7CD545CB04

Function 0000000140096828 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001400968A1
RtlLookupFunctionEntry.KERNEL32 ref: 00000001400968B9
RtlVirtualUnwind.KERNEL32 ref: 00000001400968F4
IsDebuggerPresent.KERNEL32 ref: 000000014009692D
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140096937
UnhandledExceptionFilter.KERNEL32 ref: 0000000140096942

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 18b3e5fdd1cd8cc2a5e6ef0b7725685d0a25d59a69a4c718c7a281717e56691c
Instruction ID: d26cc2fd36ed465307e52bae6993abbfc5e3a174f8213072b128481ce9152def
Opcode Fuzzy Hash: 18b3e5fdd1cd8cc2a5e6ef0b7725685d0a25d59a69a4c718c7a281717e56691c
Instruction Fuzzy Hash: E9315E32614B8096DB61CF26E8403EE73A4F788794F544226FB9D43BA9DF38C5568B00

Function 0000000140033A30 Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 699COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 0000000140034A48, 0000000140034A8C
filename, xrefs: 0000000140034624
content, xrefs: 0000000140034749

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Crypt$AlgorithmProvider$CloseGenerateOpenPropertySymmetric
String ID: content$filename$ios_base::badbit set
API String ID: 4024084497-879919306
Opcode ID: 14c71fb6276344ef19c53a2a71fb7fb04c5672c6c98d0b482d8362fcc0b25232
Instruction ID: 6a15648fd45475ec90e58d21107993b85f51eda2aafa867f6bfef3ffdab46c03
Opcode Fuzzy Hash: 14c71fb6276344ef19c53a2a71fb7fb04c5672c6c98d0b482d8362fcc0b25232
Instruction Fuzzy Hash: EF82D132119BC595D6B28B15F8803DAB3A4F7C9780F505226EBCD53BA9EF78C594CB40

Function 00000001400BC0C4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400BC125
IsDebuggerPresent.KERNEL32 ref: 00000001400BC13D
OutputDebugStringW.KERNEL32 ref: 00000001400BC14E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400BC147

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 43761d7ed95dfb62d4f325219cf79311bad23dd39b30918d63012676194dbb3d
Instruction ID: b65f4da7e0dac3f6acdcda201eed9de570067186433dc723f279dd9dd717984a
Opcode Fuzzy Hash: 43761d7ed95dfb62d4f325219cf79311bad23dd39b30918d63012676194dbb3d
Instruction Fuzzy Hash: 90115A32210B40A7FB469B67E6953E933A4FB48794F448125D74983AA1EF78D0B8C750

Function 00000001400978F8 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 000000014009794F
GetSystemInfo.KERNEL32 ref: 0000000140097968
VirtualAlloc.KERNEL32 ref: 00000001400979D6
VirtualProtect.KERNEL32 ref: 00000001400979F1

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 98c2ba8c49363c7f84277756ec2bc7ed58b48c13a2b72fa2159cecfb20083f2f
Instruction ID: 2998d681f4290f3cdbfd7160d335f1a03f64a6088aad891686837b0353e6d884
Opcode Fuzzy Hash: 98c2ba8c49363c7f84277756ec2bc7ed58b48c13a2b72fa2159cecfb20083f2f
Instruction Fuzzy Hash: 45312632310A819EDB21CF22D8447DD63A5F749B88F844525AA4E47B68DA38D646C700

Function 00000001400B9A28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000001400B9A4E
FormatMessageA.KERNEL32 ref: 00000001400B9A81

Strings

!x-sys-default-locale, xrefs: 00000001400B9A41

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 55a1076e367a08c173ecc78b5cea65c2f0ec9f8033976bc3287741c8c55a0f17
Instruction ID: ecd46ce48cd802a89ea887e817bce2d3b7e480950ffb0d184572ec913a52b2bd
Opcode Fuzzy Hash: 55a1076e367a08c173ecc78b5cea65c2f0ec9f8033976bc3287741c8c55a0f17
Instruction Fuzzy Hash: 73018CB2704B8182E7268B53B4507AAA7A5F788BD4F088015EB4547AA9DB3CC505C740

Function 00000001400A7988 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400987AC: GetLastError.KERNEL32 ref: 00000001400987BB
Part of subcall function 00000001400987AC: FlsGetValue.KERNEL32 ref: 00000001400987D0
Part of subcall function 00000001400987AC: SetLastError.KERNEL32 ref: 000000014009885B

Part of subcall function 00000001400987AC: FlsSetValue.KERNEL32 ref: 00000001400987F1

GetLocaleInfoW.KERNEL32 ref: 00000001400A79F4

Part of subcall function 000000014008E460: _invalid_parameter_noinfo.LIBCMT ref: 000000014008E47D

GetLocaleInfoW.KERNEL32 ref: 00000001400A7A3D

Part of subcall function 000000014008E460: _invalid_parameter_noinfo.LIBCMT ref: 000000014008E4D6

GetLocaleInfoW.KERNEL32 ref: 00000001400A7B05

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 673738c239811e8e6aaf94bb473114a5deef8476c39fa87607a7713143cb4c6a
Instruction ID: 9e1b7eb3e14f3d8ac36dcfc1f2b4f11521ad031e9c983c2225f320651a2be65f
Opcode Fuzzy Hash: 673738c239811e8e6aaf94bb473114a5deef8476c39fa87607a7713143cb4c6a
Instruction Fuzzy Hash: 6761C3722106419AEB368F12E940BED73A5F7A87C4F04C225EB9E976E1DB3CD591CB10

Function 000000014009C8E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000000014009C954

Strings

GetLocaleInfoEx, xrefs: 000000014009C8FC, 000000014009C90D

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 2b548483d6ca9974e9528b0b11ada6c599aa6070ea1349b93d38a40a587da536
Instruction ID: faaad8ddc682d51d181ac9566c78053e2375318c11b0efb789bebad2f8088488
Opcode Fuzzy Hash: 2b548483d6ca9974e9528b0b11ada6c599aa6070ea1349b93d38a40a587da536
Instruction Fuzzy Hash: E8016D71704B8096EB469B57F4447DAA760EB9CBD0F584026FF4907BB9CE38C5428750

Function 0000000140076F20 Relevance: 3.2, APIs: 2, Instructions: 248COMMON

Download Yara Rule

APIs

BCryptDecrypt.BCRYPT ref: 00000001400770E0

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CryptDecrypt
String ID:
API String ID: 2620231605-0
Opcode ID: 3f72a23f1a509a65aa81e6d6b4530ce515d9c6eb0a3b9f4af59a408d351eb8e9
Instruction ID: d84c1dc56733cdec245b05dd482f086fb593878f4377b85cef3af088a038052b
Opcode Fuzzy Hash: 3f72a23f1a509a65aa81e6d6b4530ce515d9c6eb0a3b9f4af59a408d351eb8e9
Instruction Fuzzy Hash: 1FB16872B08B809AEB12CB66E4507AD37B1F3497C8F008216EF5C17BA9DB79C599D340

Function 0000000140036C90 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140036D1D
LocalFree.KERNEL32 ref: 0000000140036DAF

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: e459822f5a965e7c6491091ff3b3fd437f3160b492302602bf1c7777a9c0efb9
Instruction ID: 4a8dd4eae84605777de1b5a55a80b2e635676b3498c47d1070251cd38370cd5e
Opcode Fuzzy Hash: e459822f5a965e7c6491091ff3b3fd437f3160b492302602bf1c7777a9c0efb9
Instruction Fuzzy Hash: DB616932B14B809AF712DFB5E4503DD77A1E75978CF008229EB8917EAADB78C5A49340

Function 0000000140076DC0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 0000000140076E18
LocalFree.KERNEL32 ref: 0000000140076EAA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: cb202edfd23743d2fd92808a2a0732f52d9921990abee17e7841283a167b08e9
Instruction ID: fc4154c7915ed78d34f09a56cb44b59f23928a8851b000cbb18bd55c4212d758
Opcode Fuzzy Hash: cb202edfd23743d2fd92808a2a0732f52d9921990abee17e7841283a167b08e9
Instruction Fuzzy Hash: A5414032614B80CAE3219F75E8403ED37A4F75878CF084229BB8917E9ADB79C6A4C754

Function 00000001400A7BD0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400987AC: GetLastError.KERNEL32 ref: 00000001400987BB
Part of subcall function 00000001400987AC: FlsGetValue.KERNEL32 ref: 00000001400987D0
Part of subcall function 00000001400987AC: SetLastError.KERNEL32 ref: 000000014009885B

Part of subcall function 00000001400987AC: FlsSetValue.KERNEL32 ref: 00000001400987F1

GetLocaleInfoW.KERNEL32 ref: 00000001400A7C38

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: fded36e5e65a151f08a0f66363fda748c04ed3a24ba9da3fcc630165be26dd08
Instruction ID: 8cd3d3dfa80cbff10c7d00d3e39445a1fedefada0f8de76d674014353bb7882c
Opcode Fuzzy Hash: fded36e5e65a151f08a0f66363fda748c04ed3a24ba9da3fcc630165be26dd08
Instruction Fuzzy Hash: 8F31A23270468586EB69CB23E8417EE73A1F79C7C5F40C229AB4D833A6DF38D5918B00

Function 00000001400A7820 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400987AC: GetLastError.KERNEL32 ref: 00000001400987BB
Part of subcall function 00000001400987AC: FlsGetValue.KERNEL32 ref: 00000001400987D0
Part of subcall function 00000001400987AC: SetLastError.KERNEL32 ref: 000000014009885B

EnumSystemLocalesW.KERNEL32 ref: 00000001400A78BE

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 079d62a3b16f0b0a01b59833b99c059b9cb939bc8a4f10147e07732002005d14
Instruction ID: 46995d5bafc0c3402748cc3b4101f87f573535573610cbd06ba996400d9f120b
Opcode Fuzzy Hash: 079d62a3b16f0b0a01b59833b99c059b9cb939bc8a4f10147e07732002005d14
Instruction Fuzzy Hash: B411E473A146448AEB168F16D844BDC7BA0F3A4BE0F558216E719433E4DB38C5D1CB40

Function 00000001400A7DD8 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400987AC: GetLastError.KERNEL32 ref: 00000001400987BB
Part of subcall function 00000001400987AC: FlsGetValue.KERNEL32 ref: 00000001400987D0
Part of subcall function 00000001400987AC: SetLastError.KERNEL32 ref: 000000014009885B

GetLocaleInfoW.KERNEL32 ref: 00000001400A7E0F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: f3e7ee2f1e66ffaf43a4bced11d96202e06a1caf3c24797c856a856d3c8d1eb4
Instruction ID: f16e9421c9f2d1d566c09731a7727aa721697d00e81b9315a0a2733411359802
Opcode Fuzzy Hash: f3e7ee2f1e66ffaf43a4bced11d96202e06a1caf3c24797c856a856d3c8d1eb4
Instruction Fuzzy Hash: F411A73271465183E77AC626A840F9E7261E79C7E4F548761E76D476E4DA36CCC18B00

Function 00000001400A78F0 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400987AC: GetLastError.KERNEL32 ref: 00000001400987BB
Part of subcall function 00000001400987AC: FlsGetValue.KERNEL32 ref: 00000001400987D0
Part of subcall function 00000001400987AC: SetLastError.KERNEL32 ref: 000000014009885B

EnumSystemLocalesW.KERNEL32 ref: 00000001400A796E

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 74688f5bb3302222e7b7870a00f7552f5ce206872596a426f55045067d3bf4cb
Instruction ID: 93d18b90c9ad416a7767668315f223f5f191bc074b56e8ec44abd2766402557f
Opcode Fuzzy Hash: 74688f5bb3302222e7b7870a00f7552f5ce206872596a426f55045067d3bf4cb
Instruction Fuzzy Hash: 0101F77270428086E7264F17E840FDEB6E5E768BE4F45C322E769472E5DB7484C5CB00

Function 00000001400772C0 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BCryptCloseAlgorithmProvider.BCRYPT ref: 00000001400772D9

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AlgorithmCloseCryptProvider
String ID:
API String ID: 3378198380-0
Opcode ID: 1c8b21d10fd9b400f35e2c8dd6f8ddd75c7af018214b600343906388e6c3a10d
Instruction ID: 900497187b3b4a0feb06abdb1ee795e4bdb6587cd79a1e1914cdb7c24f71ecd3
Opcode Fuzzy Hash: 1c8b21d10fd9b400f35e2c8dd6f8ddd75c7af018214b600343906388e6c3a10d
Instruction Fuzzy Hash: 3601C2B2700A8491EB159B22D4147AD2361E74CFC8F944411EF4D076A9EF7DC8958380

Function 000000014009C3A0 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000000014009C3EF

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 12efd337fa0535e7eae3a7ae34cc0435095ae515fa5323edd15366a4afb89750
Instruction ID: af0fca8f4bd2b2ee9942c1d59f6fd3f147f5c30faaa08c128de7f41e83c5a0a7
Opcode Fuzzy Hash: 12efd337fa0535e7eae3a7ae34cc0435095ae515fa5323edd15366a4afb89750
Instruction Fuzzy Hash: 01F032B2300B4083E705DB6AE8917D963A2F7ADBC0F158129EB4987379DE3CC9A1C740

Function 00000001400D3008 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction ID: feaac658b55cd5a518db28881bd34f119ec81d8d184e8a90d42a3b47355d6b8e
Opcode Fuzzy Hash: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction Fuzzy Hash: 0AF0CDABA1D7D45AE35356250C7E3CC2FA19BAAFA2F8D804AAB40835D3905A0C079361

Function 00000001400D3718 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8237b216de9d9a066abcd393a2c4069bfa76417ce4e254e20f0625e9b59a03dd
Instruction ID: f7555e13b67f83bd5e4671688c2997cb84ca8aa1e17461c55e46489618308b5b
Opcode Fuzzy Hash: 8237b216de9d9a066abcd393a2c4069bfa76417ce4e254e20f0625e9b59a03dd
Instruction Fuzzy Hash: 11E09AA761EBD04EE3634A350C2938C2FB09BA6F90F8E8097D790832D3D45D0C0A8731

Function 00000001400D3398 Relevance: .0, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2580bbaa354115e7f20c0c041466b1133d77912a340e4dfa20e2b14a994162f
Instruction ID: 807357067a33cd9dbbc180bd060d868107053995f6cb2ef0b650bc1105693623
Opcode Fuzzy Hash: c2580bbaa354115e7f20c0c041466b1133d77912a340e4dfa20e2b14a994162f
Instruction Fuzzy Hash: 7CE04F97A4EAC01DF31742600E3F74C1ED15F7AB01F4C808ED784036E3B89D6D058221

Function 00000001400D3700 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013c9eb1bbae44dc1fe28faa0fbcf7e9e22a98f8467d9c8eac31ad16be168e19
Instruction ID: 0f0087ff7abf1e05183dbc0c12280a4f3ab72410a3df019b4580b266f686766c
Opcode Fuzzy Hash: 013c9eb1bbae44dc1fe28faa0fbcf7e9e22a98f8467d9c8eac31ad16be168e19
Instruction Fuzzy Hash: 89A002FBA548A4ADF77A04058C867C80BD1AF2E350E090000A900434925069445F1150

Function 00000001400D3658 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2399e545077be4c239cdb40de846485da12f3b9bab83b8262a0220d2cfdd1bc
Instruction ID: 8ce1e87cc5c7ca1878e14d3a9fd1ee2c8b6aee086471b09dfc4fcf91158af670
Opcode Fuzzy Hash: a2399e545077be4c239cdb40de846485da12f3b9bab83b8262a0220d2cfdd1bc
Instruction Fuzzy Hash:

Function 00000001400D3090 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction ID: da55c2c18e9676a3eb711f31b27adcba68c4fdb093675fe9984136224095ec55
Opcode Fuzzy Hash: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction Fuzzy Hash:

Function 0000000140073930 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140073986
Process32FirstW.KERNEL32 ref: 00000001400739CA
Process32NextW.KERNEL32 ref: 00000001400739DF
OpenProcess.KERNEL32 ref: 0000000140073A1B
OpenProcessToken.ADVAPI32 ref: 0000000140073A42
GetTokenInformation.ADVAPI32 ref: 0000000140073A6E
GetLastError.KERNEL32 ref: 0000000140073A7C
GetTokenInformation.ADVAPI32 ref: 0000000140073ABC
ConvertSidToStringSidA.ADVAPI32 ref: 0000000140073AD3
CloseHandle.KERNEL32 ref: 0000000140073B46
CloseHandle.KERNEL32 ref: 0000000140073B51
CloseHandle.KERNEL32 ref: 0000000140073BB6
Process32NextW.KERNEL32 ref: 0000000140073BC3
CloseHandle.KERNEL32 ref: 0000000140073BE9
CloseHandle.KERNEL32 ref: 0000000140073BF2
CloseHandle.KERNEL32 ref: 0000000140073C07

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: 7edf554f1bf2a2b69477646fe94745f43607bc3d76044443717152cf58783ea9
Instruction ID: f53f4db26f8ffbc74954225dbf8234fb85c2b61d4e8944f31e63d5fabcb49364
Opcode Fuzzy Hash: 7edf554f1bf2a2b69477646fe94745f43607bc3d76044443717152cf58783ea9
Instruction Fuzzy Hash: 66813736214B8182FB529B27E84479EA7A4FB8CBD4F404125EF8A57BA8DF7CC545CB00

Function 0000000140056B00 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 202COMMON

Download Yara Rule

Strings

unexpected key without object, xrefs: 00000001400581EA
key opened, but never closed, xrefs: 00000001400582BF
unexpected '}', xrefs: 0000000140058313
object is not closed with '}', xrefs: 000000014005810F
No closed word, xrefs: 0000000140058217, 000000014005823E
word wasnt properly ended, xrefs: 0000000140058265, 00000001400582EC
quote was opened but not closed., xrefs: 0000000140058136, 00000001400581AB
key declared, but no value, xrefs: 000000014005815D, 0000000140058184, 0000000140058298

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID: No closed word$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-2700065129
Opcode ID: b9eb38c5ab060a2dda8520568620628a99a67b8189105732fd21080a6df660b0
Instruction ID: f9c7333ff1f4887109b71b21fa7058ec3d63239c43aa84505dd9f7712b489e47
Opcode Fuzzy Hash: b9eb38c5ab060a2dda8520568620628a99a67b8189105732fd21080a6df660b0
Instruction Fuzzy Hash: 0BB11071601AC6A5EB72DF21DC917D833A4F759388F415216E74C4B9B9EF74C689C700

Function 000000014008EB14 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008EB43
_invalid_parameter_noinfo.LIBCMT ref: 000000014008EC13

Strings

0, xrefs: 000000014008EC3D
0, xrefs: 000000014008EBE5
0, xrefs: 000000014008EC4F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction ID: 3ec9a172ff9cd9a56723fab73356c2b78239a766e83f6ecce63c72710ed58d98
Opcode Fuzzy Hash: 4b936a4394e80428ad7bf41d875096a3e7add69c0315c25dc0869b4c3066c4ac
Instruction Fuzzy Hash: 55E1D3335056D58AF7629F2A94903ED3BA5F35ABC4F588022FB85477F2C7398A5AC301

Function 0000000140079DA0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140079E1D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140079E65
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140079FE1
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140079FF4
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140079FFA

Strings

true, xrefs: 0000000140079F1C
bad locale name, xrefs: 0000000140079FE7
false, xrefs: 0000000140079EED

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 89e8eebeb0e5851c78bde8427c4241be1561912327ea848c90b167f0a42bcdf2
Instruction ID: 9f833d7ac4b076529d01c46f3f154de4dc3d8a729371acaec3c7ca5394b3b07c
Opcode Fuzzy Hash: 89e8eebeb0e5851c78bde8427c4241be1561912327ea848c90b167f0a42bcdf2
Instruction Fuzzy Hash: F7711B32702B408AEB16DFB2D4503EC37B6EB58788F144129EB4967BA9DB38C515D344

Function 00007FF608079B9C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF608079B6C,?,?,00000000,00007FF60807BCDB,?,?,?,00007FF608076809), ref: 00007FF608079D18
GetProcAddress.KERNEL32(?,?,?,00007FF608079B6C,?,?,00000000,00007FF60807BCDB,?,?,?,00007FF608076809), ref: 00007FF608079D24

Strings

ext-ms-, xrefs: 00007FF608079C75
MZx, xrefs: 00007FF608079BBB, 00007FF608079CA1, 00007FF608079D01
api-ms-, xrefs: 00007FF608079C62

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: a5097e6e42886596c98c0385f634c4aef1c640e8f28c7c219958798091b78743
Instruction ID: 6fd1967041e5f9ac08e2058ea3befd94d2f68fe26977aff1880d968d81d546cd
Opcode Fuzzy Hash: a5097e6e42886596c98c0385f634c4aef1c640e8f28c7c219958798091b78743
Instruction Fuzzy Hash: EE41DE22F19A0281FB1ACB36981467527D6BF88BA0F294535DD0ECB7C5EE3CE445830C

Function 0000000140088720 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140088751
GetProcessId.KERNEL32 ref: 000000014008875A
RmStartSession.RSTRTMGR ref: 000000014008877A
RmRegisterResources.RSTRTMGR ref: 00000001400887A5
RmGetList.RSTRTMGR ref: 00000001400887DE
RmGetList.RSTRTMGR ref: 0000000140088840
RmEndSession.RSTRTMGR ref: 000000014008887B
RmEndSession.RSTRTMGR ref: 00000001400888B2
RmEndSession.RSTRTMGR ref: 00000001400888C7

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: d42b2751b4845f6e5fc378a235a32170e364fb9c24da67feea4ad67c232641f0
Instruction ID: 3625db88a6373b96de9670bab8ed7edf633392ac4bb2a85a491946533c032ab6
Opcode Fuzzy Hash: d42b2751b4845f6e5fc378a235a32170e364fb9c24da67feea4ad67c232641f0
Instruction Fuzzy Hash: A6512A32B10A418AF725CFA6E4507DD33B1B74C7D8F90452AEE0A63BA8DE38C906C750

Function 00007FF608078F5C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF608078FB9

Part of subcall function 00007FF608078424: __GetUnwindTryBlock.LIBCMT ref: 00007FF608078467
Part of subcall function 00007FF608078424: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF60807848C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF608079091
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6080792DF
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6080793EC

Strings

csm, xrefs: 00007FF6080790B4
csm, xrefs: 00007FF608078FD3
csm, xrefs: 00007FF60807903A

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 0099af5d98ffdce3721754b948236ddbf4b8c0d9695b8f044c3694728437dd46
Instruction ID: 0483e54aeef2c64c825c9004a58d5a2173fd8f2e2b30ed2dd8654dcbb403186f
Opcode Fuzzy Hash: 0099af5d98ffdce3721754b948236ddbf4b8c0d9695b8f044c3694728437dd46
Instruction Fuzzy Hash: B5D17C72E08B418AEB60DB7594453AD7BA0FB55788F204235EA4E97BD6CF3CE091C748

Function 00000001400B0304 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000001400B0361

Part of subcall function 00000001400B271C: __GetUnwindTryBlock.LIBCMT ref: 00000001400B275F
Part of subcall function 00000001400B271C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000001400B2784

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000001400B0439
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000001400B0687
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400B0794

Strings

csm, xrefs: 00000001400B03E2
csm, xrefs: 00000001400B045C
csm, xrefs: 00000001400B037B

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 66fcb54f63042a77bb9752ac00b10eb6a43643c2f85347937ebb7186689712c3
Instruction ID: 2dddcf81e393266e6dd364431a01f1ce124f9e37c2573fe0043309711653aeb7
Opcode Fuzzy Hash: 66fcb54f63042a77bb9752ac00b10eb6a43643c2f85347937ebb7186689712c3
Instruction Fuzzy Hash: 9BD14A72A04B808AEB22DFA694413DD77B0F759BD8F104216EF8957BA6DF38D491CB00

Function 00007FF608074340 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF608074399

Strings

h, xrefs: 00007FF6080743DA
@, xrefs: 00007FF6080744C7
U, xrefs: 00007FF60807441F

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: FileModuleName
String ID: @$U$h
API String ID: 514040917-1769436074
Opcode ID: 30403d80bbda924b6a9616881aacd3132cf0f86eb79a681510f7f61da3fc2d23
Instruction ID: 73dede853b80022d941c14f30a05cf942b3246729e164447ce475acf2b1ecb3c
Opcode Fuzzy Hash: 30403d80bbda924b6a9616881aacd3132cf0f86eb79a681510f7f61da3fc2d23
Instruction Fuzzy Hash: 79711F76A08BC5C1DA60CB55F4503AEB760FBC9B94F504026EA8E87BA9DF7CD045CB08

Function 000000014009C41C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000000014009C598
GetProcAddress.KERNEL32 ref: 000000014009C5A4

Strings

api-ms-, xrefs: 000000014009C4E2
ext-ms-, xrefs: 000000014009C4F5

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2932ed60a38164b99968e515f80e2e6bc9311783d2898aba8cd640b210738e5b
Instruction ID: 8b663572d4e9df061dfb5452e7c122c2f59b72ac8eb05063979d288c5e28a2e1
Opcode Fuzzy Hash: 2932ed60a38164b99968e515f80e2e6bc9311783d2898aba8cd640b210738e5b
Instruction Fuzzy Hash: 7641C4B1721B1082FA17DB17A914BDA27D5BB4DBE0F4A4529FF098B7A4DE3CD4868300

Function 00007FF60807D75C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF60807D72E,?,?,?,00007FF6080798A4,?,?,?,00007FF6080764AD), ref: 00007FF60807D7E1
GetLastError.KERNEL32(?,?,?,00007FF60807D72E,?,?,?,00007FF6080798A4,?,?,?,00007FF6080764AD), ref: 00007FF60807D7EF
LoadLibraryExW.KERNEL32(?,?,?,00007FF60807D72E,?,?,?,00007FF6080798A4,?,?,?,00007FF6080764AD), ref: 00007FF60807D819
FreeLibrary.KERNEL32(?,?,?,00007FF60807D72E,?,?,?,00007FF6080798A4,?,?,?,00007FF6080764AD), ref: 00007FF60807D887
GetProcAddress.KERNEL32(?,?,?,00007FF60807D72E,?,?,?,00007FF6080798A4,?,?,?,00007FF6080764AD), ref: 00007FF60807D893

Strings

MZx, xrefs: 00007FF60807D77A, 00007FF60807D82A, 00007FF60807D870
api-ms-, xrefs: 00007FF60807D801

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: MZx$api-ms-
API String ID: 2559590344-259127448
Opcode ID: 5289a04243e8a248cb5820b37202154a20ba6c64b1fa020b3a1c062f1bb2b80b
Instruction ID: ca621fca396683ac0bf48e700c8205065d8e3701cfb6f3f92027ede6ba597763
Opcode Fuzzy Hash: 5289a04243e8a248cb5820b37202154a20ba6c64b1fa020b3a1c062f1bb2b80b
Instruction Fuzzy Hash: F6319E21F1AB4281FE56DB62A8006756298BF48BB0F690535DD2E8A7D5EE7CE441830C

Function 000000014007A1D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 000000014007A23B
InternetOpenUrlA.WININET ref: 000000014007A270
InternetReadFile.WININET ref: 000000014007A291
InternetReadFile.WININET ref: 000000014007A2CF
InternetCloseHandle.WININET ref: 000000014007A2DC
InternetCloseHandle.WININET ref: 000000014007A2E5

Strings

File Downloader, xrefs: 000000014007A234

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: ef0b4a100551ad57f85878d3ad68814330c2d85b7b679f70ec8f93c3db496011
Instruction ID: 0399ce1682de07f0aa1206abe99c22717857691dc5a833c9d493158f508467bf
Opcode Fuzzy Hash: ef0b4a100551ad57f85878d3ad68814330c2d85b7b679f70ec8f93c3db496011
Instruction Fuzzy Hash: C5316732214B8082EB218F26F85479AB3A0FB89BC4F585115FF8943B69DF7DC5928B00

Function 00000001400921B0 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400921F3
_invalid_parameter_noinfo.LIBCMT ref: 00000001400925E0
_invalid_parameter_noinfo.LIBCMT ref: 000000014009287C

Strings

p, xrefs: 000000014009231D
p, xrefs: 00000001400922A5
f, xrefs: 0000000140092315

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction ID: b8dc3e9cdc22bec2f5ab832ac5804bf8a86bae0c64d7de0205dfc1d31eeff702
Opcode Fuzzy Hash: eea83e675726579202ae46558f478e57f494447b85c4049c91ddb9471f815998
Instruction Fuzzy Hash: 4F12B27260924286FB26AF17E0547FEB6A1F3587D4FD94116F79247AE4D738C980CB10

Function 00000001400B2C8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000001400B2D11
GetLastError.KERNEL32 ref: 00000001400B2D1F
LoadLibraryExW.KERNEL32 ref: 00000001400B2D49
FreeLibrary.KERNEL32 ref: 00000001400B2DB7
GetProcAddress.KERNEL32 ref: 00000001400B2DC3

Strings

api-ms-, xrefs: 00000001400B2D31

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 996ade3048ece8fd6c5d5c54d4ec564cddc8ae1be39e9acb717a9eca008d3d5f
Instruction ID: cc2d99b39676e9a48d292cfa973c6d7b264006a7d65043fdb1f58a40d0113fec
Opcode Fuzzy Hash: 996ade3048ece8fd6c5d5c54d4ec564cddc8ae1be39e9acb717a9eca008d3d5f
Instruction Fuzzy Hash: 8C315A31312A4092EE279F97A90479923A4BB5CBE4F4A4525FE2A4B7B4EF38D446C350

Function 00000001400987AC Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400987BB
FlsGetValue.KERNEL32 ref: 00000001400987D0
FlsSetValue.KERNEL32 ref: 00000001400987F1
FlsSetValue.KERNEL32 ref: 000000014009881E
FlsSetValue.KERNEL32 ref: 000000014009882F
FlsSetValue.KERNEL32 ref: 0000000140098840
SetLastError.KERNEL32 ref: 000000014009885B

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 836497dfc4d51253c0b26693416316fb41dfea5a35bfeb46f288bec0a731183c
Instruction ID: 4b4d8deacd497249436f39071c19fb311b5fdefea0622a1cc046aa47ab187ae1
Opcode Fuzzy Hash: 836497dfc4d51253c0b26693416316fb41dfea5a35bfeb46f288bec0a731183c
Instruction Fuzzy Hash: 2921937070824042FA6767775A927EE52928B4C7F0F544B28BF3657BF6DE38C4524B01

Function 00007FF608080CA0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF608080CD1
GetLastError.KERNEL32 ref: 00007FF608080CDD
CloseHandle.KERNEL32 ref: 00007FF608080CF5
CreateFileW.KERNEL32 ref: 00007FF608080D20
WriteConsoleW.KERNEL32 ref: 00007FF608080D3F

Strings

CONOUT$, xrefs: 00007FF608080D01

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: eccb84783a33b6acb2369927ad856cb4a6f1e39df1dbbcb1c74e1911e2e9c731
Instruction ID: 57cead7593419f7ad3ff2c2afd2dc33a8854c90de71cdc5fdc2022e34017f072
Opcode Fuzzy Hash: eccb84783a33b6acb2369927ad856cb4a6f1e39df1dbbcb1c74e1911e2e9c731
Instruction Fuzzy Hash: 78115421718B42C6E754CBA2E844729A7A0FB88BE4F284234D95EC7B94DFBCD5448748

Function 00000001400AB18C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001400AB1BD
GetLastError.KERNEL32 ref: 00000001400AB1C9
CloseHandle.KERNEL32 ref: 00000001400AB1E1
CreateFileW.KERNEL32 ref: 00000001400AB20C
WriteConsoleW.KERNEL32 ref: 00000001400AB22B

Strings

CONOUT$, xrefs: 00000001400AB1ED

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 423033ad9a26eeb1fe2838e88a30b5d5e8e126e9df3eade86433f6e59bd70d34
Instruction ID: dccac7cf86dd691c8986e58b5ea5a29b4595da972c7e7c068490d770517f9d1c
Opcode Fuzzy Hash: 423033ad9a26eeb1fe2838e88a30b5d5e8e126e9df3eade86433f6e59bd70d34
Instruction Fuzzy Hash: 23116A31714A8086E7628B57E8543A9A7A0FB9CFE4F444228FF5A87BA4DF7CC9458740

Function 00000001400BBCEC Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400BBD99
MultiByteToWideChar.KERNEL32 ref: 00000001400BBE35
MultiByteToWideChar.KERNEL32 ref: 00000001400BBEDE
MultiByteToWideChar.KERNEL32 ref: 00000001400BBF08
MultiByteToWideChar.KERNEL32 ref: 00000001400BBFB0
CompareStringEx.KERNEL32 ref: 00000001400BBFFD

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: a1f78f492e3696b6019f48ed1e7001af74d1872a9e55038d413a28a56ba35231
Instruction ID: bcf1b6b93dcecc1946cad78135b827772f34e8b074e1d02fcb1409f9e20e2999
Opcode Fuzzy Hash: a1f78f492e3696b6019f48ed1e7001af74d1872a9e55038d413a28a56ba35231
Instruction Fuzzy Hash: D5A1C172210A8086FB329FA6D4547ED77A1E74CBE8F584621FB690B7E5EB78C9458300

Function 00000001400BB98C Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400BB9FC
MultiByteToWideChar.KERNEL32 ref: 00000001400BBA9A
LCMapStringEx.KERNEL32 ref: 00000001400BBB03
LCMapStringEx.KERNEL32 ref: 00000001400BBB55
LCMapStringEx.KERNEL32 ref: 00000001400BBBFA
WideCharToMultiByte.KERNEL32 ref: 00000001400BBC54

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 270ae4f9d9f08dcff0b9067bef15d1f35fc8560d5ec39fb7ed6a8b55e081ca3d
Instruction ID: 3cae8b1818a4245b37a95ea3dbb25334b2cbdcdea68dea16613d2c78e82ac99f
Opcode Fuzzy Hash: 270ae4f9d9f08dcff0b9067bef15d1f35fc8560d5ec39fb7ed6a8b55e081ca3d
Instruction Fuzzy Hash: 8D81B172200B4087EB22CF66E4407A9B7E5FB58BE8F144625FB5A47BE8DFB8C5458700

Function 000000014008F100 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008F172
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F1A3
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F1E3
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F225
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F25A
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F2D7

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cdce36b549f9a139a57fc9ed1dc92bc6bf26bb61d742b9d05d56d54ff17284a9
Instruction ID: 1d4139813600b4928fe05de513d8c91a672c6bd4c6413c1d6dc083dce2f2dfb8
Opcode Fuzzy Hash: cdce36b549f9a139a57fc9ed1dc92bc6bf26bb61d742b9d05d56d54ff17284a9
Instruction Fuzzy Hash: 0D516177105A84C6FB639F36E4903FD7B91B74ABC4F588011E7C8473A6CA398946D702

Function 00000001400B07D4 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000001400B0972
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400B0C9B

Strings

csm, xrefs: 00000001400B08B9
csm, xrefs: 00000001400B0999
csm, xrefs: 00000001400B091B

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 9f4e64e61b5b2eeaf6a6c9105b8820c6d72dd74f9dd23350b1755da3e83c2826
Instruction ID: 151a497a614de7a2d148bc646ebc8b93af069f99db54679d45a2247bfb3a51cc
Opcode Fuzzy Hash: 9f4e64e61b5b2eeaf6a6c9105b8820c6d72dd74f9dd23350b1755da3e83c2826
Instruction Fuzzy Hash: 95E17D73504B808AE722DFA6D4813ED7BB0F759B98F144216EF89577A6DB34D582CB00

Function 0000000140098924 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140098933
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140093731,?,?,?,?,000000014009BCBC), ref: 0000000140098969
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140093731,?,?,?,?,000000014009BCBC), ref: 0000000140098996
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140093731,?,?,?,?,000000014009BCBC), ref: 00000001400989A7
FlsSetValue.KERNEL32(?,?,-2723E8D8DEBC5093,0000000140093731,?,?,?,?,000000014009BCBC), ref: 00000001400989B8
SetLastError.KERNEL32 ref: 00000001400989D3

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 3e50834227e15001dfc7d0ee3d9f2b245d3937db225a59ccfd7316e65e1e5031
Instruction ID: 7761718c07057579b4a836c862f773882c17a7b063c5f03bbeab8f09a7883271
Opcode Fuzzy Hash: 3e50834227e15001dfc7d0ee3d9f2b245d3937db225a59ccfd7316e65e1e5031
Instruction Fuzzy Hash: 91117F7071824042FA67A32756927FE62929B4C7F0F084728BF76577F6DE38C4528B02

Function 00007FF60807E510 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF60807E58F
WriteFile.KERNEL32 ref: 00007FF60807E857
WriteFile.KERNEL32 ref: 00007FF60807E89D
GetLastError.KERNEL32 ref: 00007FF60807E953

Strings

MZx, xrefs: 00007FF60807E566, 00007FF60807E5E7, 00007FF60807E69C

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: 56001a688be59e779d38c89167cf0233533a9f369d0b07dbb42eba76e8af94f0
Instruction ID: 1badf4745675719ff1fc96fff321145c4c9661e84d8a63d6e3dd76ad601a8fdf
Opcode Fuzzy Hash: 56001a688be59e779d38c89167cf0233533a9f369d0b07dbb42eba76e8af94f0
Instruction Fuzzy Hash: FFD1F132F0AA8189E751CFB9D4402AC37B1FB44B98B644276DE5E97BD9DE38D016C348

Function 000000014002DCE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000000014002DD3F

Part of subcall function 00000001400B9B18: AreFileApisANSI.KERNEL32 ref: 00000001400B9B2A

__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DFE7
__std_exception_destroy.LIBVCRUNTIME ref: 000000014002E0A1

Strings

: ", xrefs: 000000014002DDFA
", ", xrefs: 000000014002DE2D

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: e0d029aff27b5b87cb7dc18beb66e1f04c68dd470f282bd7f8376167e192a860
Instruction ID: 2fc4354da3f7ac5633768660396deded93c7b25156e114866fa5e57279866451
Opcode Fuzzy Hash: e0d029aff27b5b87cb7dc18beb66e1f04c68dd470f282bd7f8376167e192a860
Instruction Fuzzy Hash: 23B1AD72700A8096EB01EF66E0843ED3361E759BC8F508526EF5D17BAADF78C895C384

Function 00007FF608076790 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6080767B5
GetProcAddress.KERNEL32 ref: 00007FF6080767CB
FreeLibrary.KERNEL32 ref: 00007FF6080767F2

Strings

mscoree.dll, xrefs: 00007FF6080767AC
CorExitProcess, xrefs: 00007FF6080767C4

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 56dec27a48c382bae8c9dbc998320d3297bdff6e0d22f776c03b946996f6de0c
Instruction ID: 66e2ea5acac81d5a462cdf3ef438c3d1b5e8940740be0c163bda62ad3237f562
Opcode Fuzzy Hash: 56dec27a48c382bae8c9dbc998320d3297bdff6e0d22f776c03b946996f6de0c
Instruction Fuzzy Hash: 14F04FA1B19B0281EA18CB74A4443796360EF897A1F680635C96EC92E4CF6DD548C318

Function 00000001400A3878 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000001400A389D
GetProcAddress.KERNEL32 ref: 00000001400A38B3
FreeLibrary.KERNEL32 ref: 00000001400A38DA

Strings

CorExitProcess, xrefs: 00000001400A38AC
mscoree.dll, xrefs: 00000001400A3894

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: be92eb9bbaaa625829bc9471fb326967c68e4fbed633ca4a062594c979a01ac3
Instruction ID: ac3b12a74c1955f63a223aafc9c7af301689ef38f5382d6585260c25f0642c2f
Opcode Fuzzy Hash: be92eb9bbaaa625829bc9471fb326967c68e4fbed633ca4a062594c979a01ac3
Instruction Fuzzy Hash: ADF06271301B0592FB158B66E84439E5360AF9D7E1F541315F765472F8DF3CC1868710

Function 00000001400AFBD4 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00000001400AFCF7
__AdjustPointer.LIBCMT ref: 00000001400AFD42

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3f39c1b9ed79e73c84211ab22038048c5d1c6819f99b6ac50b6bfdd9f9c1b3ec
Instruction ID: e8579fd3734454176f596904cbd10330809381039630ccf5f49c986ac4bd2f62
Opcode Fuzzy Hash: 3f39c1b9ed79e73c84211ab22038048c5d1c6819f99b6ac50b6bfdd9f9c1b3ec
Instruction Fuzzy Hash: 29B19332201A8485EA67DF93D1807F967A1EB6CBD4F198626BF49077B5DB74C4C2EB00

Function 000000014009FA88 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000014009FAC7
_set_statfp.LIBCMT ref: 000000014009FAE5
_set_statfp.LIBCMT ref: 000000014009FB0E
_set_statfp.LIBCMT ref: 000000014009FD4A

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9c3edce3a00c59cfada856729e56e09c68419cddf2c103ca818f489642505782
Instruction ID: 932a995cfb9503593ddab9fc7f713a1ab8e6f93bff8132766f35255785ab954d
Opcode Fuzzy Hash: 9c3edce3a00c59cfada856729e56e09c68419cddf2c103ca818f489642505782
Instruction Fuzzy Hash: 2481D232604A4886F7778F37E9503FA66A1EB5D7D8F148301BF5A275F5D734C982AA00

Function 00007FF6080815E0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF608081608
_set_statfp.LIBCMT ref: 00007FF608081623
_set_statfp.LIBCMT ref: 00007FF60808163F
_set_statfp.LIBCMT ref: 00007FF60808167B

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction ID: ba5d86ecab265a73e0bf3fc4cf994d4798ac3bb0f6485e9b249561d8a3ab956d
Opcode Fuzzy Hash: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction Fuzzy Hash: 24114FB2E18A03C5F7569134E45637530406F653B0E3C0A34E9EF862E68EECA8D2450C

Function 00000001400989EC Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000001400967B7,?,?,00000000,0000000140096A52,?,?,?,?,-2723E8D8DEBC5093,00000001400969DE), ref: 0000000140098A0B
FlsSetValue.KERNEL32(?,?,?,00000001400967B7,?,?,00000000,0000000140096A52,?,?,?,?,-2723E8D8DEBC5093,00000001400969DE), ref: 0000000140098A2A
FlsSetValue.KERNEL32(?,?,?,00000001400967B7,?,?,00000000,0000000140096A52,?,?,?,?,-2723E8D8DEBC5093,00000001400969DE), ref: 0000000140098A52
FlsSetValue.KERNEL32(?,?,?,00000001400967B7,?,?,00000000,0000000140096A52,?,?,?,?,-2723E8D8DEBC5093,00000001400969DE), ref: 0000000140098A63
FlsSetValue.KERNEL32(?,?,?,00000001400967B7,?,?,00000000,0000000140096A52,?,?,?,?,-2723E8D8DEBC5093,00000001400969DE), ref: 0000000140098A74

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 63fad89cde5a74aa4ed2767879c0945389456cb9a64cbe5c9e44f2e2b9cc9987
Instruction ID: 5562d8217f5fbb2e2b042148076d670c8644ef2b037ad8581d2eb7d4cbc5fe19
Opcode Fuzzy Hash: 63fad89cde5a74aa4ed2767879c0945389456cb9a64cbe5c9e44f2e2b9cc9987
Instruction Fuzzy Hash: 6C118670B1824042FA6A572756527EA12815B4C7F0F485729BF3A577F6DE38C4524702

Function 00007FF60807A0DD Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF60807A0F7
FlsSetValue.KERNEL32 ref: 00007FF60807A116
FlsSetValue.KERNEL32 ref: 00007FF60807A13E
FlsSetValue.KERNEL32 ref: 00007FF60807A14F
FlsSetValue.KERNEL32 ref: 00007FF60807A160

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: fef79bcd01217ff1732ce6d7f5bbbbb61dca6c16b20e38246b54353a88e43eaf
Instruction ID: e0a38c541808009f777810909a35b581ffcad18acb7b7fedfd0e58e4e80d6d85
Opcode Fuzzy Hash: fef79bcd01217ff1732ce6d7f5bbbbb61dca6c16b20e38246b54353a88e43eaf
Instruction Fuzzy Hash: 7A116D20F0D21245FA98D379695267D62925F857F0E384738E83FC76D6DE2CB842820C

Function 0000000140098880 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000140098891
FlsSetValue.KERNEL32 ref: 00000001400988B0
FlsSetValue.KERNEL32 ref: 00000001400988D8
FlsSetValue.KERNEL32 ref: 00000001400988E9
FlsSetValue.KERNEL32 ref: 00000001400988FA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 43d04cbe9146c923b450e8e534c0ba972fd7e100807ec060178d0b2d3cf5007b
Instruction ID: cd125b27746cb6ac91a5f66ffa739dc1054c97539802566e512f256013ea258b
Opcode Fuzzy Hash: 43d04cbe9146c923b450e8e534c0ba972fd7e100807ec060178d0b2d3cf5007b
Instruction Fuzzy Hash: F21129B060820542FA7BA33758967FA12824B4C7F4F5C5728BF365B3F2DE3898524B52

Function 0000000140048890 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140048900
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140048948
_Getcoll.LIBCPMT ref: 000000014004897C

Strings

bad locale name, xrefs: 0000000140048A81

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: fab0e095f8c7ed654faf4468b22ec1401334c6b8314a09414ceb4f5f9351b23d
Instruction ID: 05c14c64210617226be52844fee93a87bdf04712ef8590b9b58c4d55bb14e304
Opcode Fuzzy Hash: fab0e095f8c7ed654faf4468b22ec1401334c6b8314a09414ceb4f5f9351b23d
Instruction Fuzzy Hash: FD918C72701B408AFB16DFB6D4503ED3362EB48BC8F444526EF5917AA9DE78C4A5C384

Function 00000001400BD99C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BDC7B

Part of subcall function 00000001400AAD6C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AAD89

Strings

UTF-16LEUNICODE, xrefs: 00000001400BDC19
ccs, xrefs: 00000001400BDBB6
UTF-8, xrefs: 00000001400BDBFA

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 9e2d0ea007b7d59ffb8b8322be5f141d45b6f7305a3d4721c3becb03152af675
Instruction ID: a7f85e871348f964b5b2985e56f5b2cb913dc045045e7003f2b8ca248ccae572
Opcode Fuzzy Hash: 9e2d0ea007b7d59ffb8b8322be5f141d45b6f7305a3d4721c3becb03152af675
Instruction Fuzzy Hash: FB818C72604A41C5FB678FAB82507E9FBB0E319BC8F568017EB06576F5E339C8419706

Function 00000001400B0F48 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000001400B0FB8
_CallSETranslator.LIBVCRUNTIME ref: 00000001400B1003

Strings

MOC, xrefs: 00000001400B0FCC
RCC, xrefs: 00000001400B0FD4

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: ff7130a31c3838eae5dc4e9040a01fbf81571be333e3600a34bda6294f9903e2
Instruction ID: 5ffffaaada14817aa3187c5423479fd319e85f9884be44b803de71811ffbdc7c
Opcode Fuzzy Hash: ff7130a31c3838eae5dc4e9040a01fbf81571be333e3600a34bda6294f9903e2
Instruction Fuzzy Hash: 4C916B73614B808AE712DFA6E8803DD7BB0F3497C8F54421AEB8957769DB38C1A5CB00

Function 00007FF608075A88 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF608075AB3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF608075B4A
RtlUnwindEx.KERNEL32 ref: 00007FF608075BA4

Strings

csm, xrefs: 00007FF608075B31

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b8fdca9cded4bbb6aa06f1f5ade378c1037bc301aacae7e2f84c1045c81e75ca
Instruction ID: 959e9f52fb52e752eb25b30e6a35b0e2236ccf789e64bab6e5c85cfd625fdc21
Opcode Fuzzy Hash: b8fdca9cded4bbb6aa06f1f5ade378c1037bc301aacae7e2f84c1045c81e75ca
Instruction Fuzzy Hash: 93517E32E196028AEB14CF25E844BBD6391EB44B98F658535EA4B877C8DF7DE841870C

Function 00007FF60807891C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF608078D4C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF608078E34

Strings

csm, xrefs: 00007FF608078D6E
csm, xrefs: 00007FF608078E86

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 67d3760316c7ac8e6f5febe830b8f7d34bf4c5dbdb36519f52684cd6ad08a349
Instruction ID: 5c48bb9da7b32dab3b217d96e45d4b03e27200f8cfc54ea481ea232098eaff29
Opcode Fuzzy Hash: 67d3760316c7ac8e6f5febe830b8f7d34bf4c5dbdb36519f52684cd6ad08a349
Instruction Fuzzy Hash: A3615D32D086828AEB74CA25954837877A1FB59B94F248135DA9EC7BD5CF3CE890C70D

Function 00007FF608079500 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF60807955F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6080795AB

Strings

MOC, xrefs: 00007FF608079573
RCC, xrefs: 00007FF60807957B

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 8256bd98bb7a5e1e5654349a1a6cf87bcda44b3a148a411127153f0ac98a1ecd
Instruction ID: 83df5bff2acae940f7ad6cba12498dbbf41047ee67c0ed67399fdefff9e6b455
Opcode Fuzzy Hash: 8256bd98bb7a5e1e5654349a1a6cf87bcda44b3a148a411127153f0ac98a1ecd
Instruction Fuzzy Hash: B461A172D08BC581D760DF25E4407AABBA0FB85B84F144225EB9E47B99DF3CE191CB08

Function 00000001400B14C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001400B14F0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000001400B15D8

Strings

csm, xrefs: 00000001400B1512
csm, xrefs: 00000001400B162A

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 095a41cf6f88e6130bf65bc0ed5de3fd02173d0230e8279c947ec4f4a2f09324
Instruction ID: 09f6dde7808521b70217c70a336bd6f0befd6cb2b189c9e0ff49262e5f14330a
Opcode Fuzzy Hash: 095a41cf6f88e6130bf65bc0ed5de3fd02173d0230e8279c947ec4f4a2f09324
Instruction Fuzzy Hash: 3E517F72600B80CAEB758F93A4443D877B4E798BD4F984225EB5A47BA9CB34C491CB01

Function 00000001400B0CD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000001400B0D37
_CallSETranslator.LIBVCRUNTIME ref: 00000001400B0D83

Strings

MOC, xrefs: 00000001400B0D4B
RCC, xrefs: 00000001400B0D53

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 07992d41df9ad80eb188af37fb9b0e6db73788ea83bdb0dcdeea906dcb818229
Instruction ID: 17eb707fb36a4e926c94bb033cda9fe31027dfba4c2e9a3a8a32eca6d0b63af4
Opcode Fuzzy Hash: 07992d41df9ad80eb188af37fb9b0e6db73788ea83bdb0dcdeea906dcb818229
Instruction Fuzzy Hash: 68617C32608BC486EB72DF56E4403EAB7A0F799BD4F044615FB9907BA9DB78D194CB00

Function 000000014002EF10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000000014002F0F0
__std_exception_destroy.LIBVCRUNTIME ref: 000000014002F0FD

Strings

, column , xrefs: 000000014002EFC8
at line , xrefs: 000000014002EF9A

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: ea0931f80faea3a1458766356af7855d0ac9163cdf1165e6ea0833dd366c92db
Instruction ID: 914463d450a43cb4f7ea3de808729a8ac489e12741d6c37c1533c495ea6b9385
Opcode Fuzzy Hash: ea0931f80faea3a1458766356af7855d0ac9163cdf1165e6ea0833dd366c92db
Instruction Fuzzy Hash: 0151A37260478081EA11DB2BE5803AE7761F78DBD4F504225FBA907BEADF78C891C740

Function 000000014002CA60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014002CACF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014002CB17
_Getctype.LIBCPMT ref: 000000014002CB55

Strings

bad locale name, xrefs: 000000014002CC0E

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 0fdf44e750821479e315e268955e66de4311686768919f7e860fce24ecb21b9a
Instruction ID: 5692f8161d49c62ceb7944d53b891567dd2b94ab8c399e88a064e650bba4c44d
Opcode Fuzzy Hash: 0fdf44e750821479e315e268955e66de4311686768919f7e860fce24ecb21b9a
Instruction Fuzzy Hash: D8514936711B408AEB16DFB2D4913ED33B5EB48788F444429EF8927AA5DF34CA25D344

Function 0000000140085DA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140085E2B

Strings

?, xrefs: 0000000140085DE0

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: fac0b721db4333e5878d97004158c7f0cb9c596c5e158db9a56ab25e623e2ca1
Instruction ID: 54d39e097882213c5b733bf086f40d23d8995db644f53b8c5f5849c5aff69d53
Opcode Fuzzy Hash: fac0b721db4333e5878d97004158c7f0cb9c596c5e158db9a56ab25e623e2ca1
Instruction Fuzzy Hash: 31418072618B8082EB51DB26F4803AEB7A0F7D97D4F105215FB9943AA9DF7CC194CB44

Function 00007FF608074F3C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF608075210: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF608075224

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF608074F60
__scrt_release_startup_lock.LIBCMT ref: 00007FF608074FCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF608075021

Strings

MZx, xrefs: 00007FF608075036

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID: MZx
API String ID: 3251591375-2575928145
Opcode ID: 541ff40e58d353be9d847ea1bee9263a9859c2f33cd014f189e106e5bf34516c
Instruction ID: 4852bfc57493b9c88f5f52196063ede76c6124c191b5d30b4d06b300dbf818c5
Opcode Fuzzy Hash: 541ff40e58d353be9d847ea1bee9263a9859c2f33cd014f189e106e5bf34516c
Instruction Fuzzy Hash: 93315D31E0C64786FA24EB7498623F92291AF81385F785435EA0FCB2D3DE6DB404C29D

Function 00000001400B9AC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400B9ADE
GetProcAddress.KERNEL32 ref: 00000001400B9AEE

Strings

GetTempPath2W, xrefs: 00000001400B9AE4
kernel32.dll, xrefs: 00000001400B9AD7

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: aba5ed2ee6ba4ce48385ce636e4a4acb6d4aac54e4449c193f436a8d268e96e8
Instruction ID: 7945943dde90ce79e9ea268502fb856af871c4c7814340627f58557ecb3581ff
Opcode Fuzzy Hash: aba5ed2ee6ba4ce48385ce636e4a4acb6d4aac54e4449c193f436a8d268e96e8
Instruction Fuzzy Hash: 48E01AB1710A4592EE069B12F9883AD6361FF8CBC1F889029EA0E07338DE3CC446C710

Function 0000000140074080 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140073930: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140073986
Part of subcall function 0000000140073930: Process32FirstW.KERNEL32 ref: 00000001400739CA
Part of subcall function 0000000140073930: Process32NextW.KERNEL32 ref: 00000001400739DF
Part of subcall function 0000000140073930: OpenProcess.KERNEL32 ref: 0000000140073A1B
Part of subcall function 0000000140073930: OpenProcessToken.ADVAPI32 ref: 0000000140073A42
Part of subcall function 0000000140073930: CloseHandle.KERNEL32 ref: 0000000140073BB6
Part of subcall function 0000000140073930: Process32NextW.KERNEL32 ref: 0000000140073BC3
Part of subcall function 0000000140073930: CloseHandle.KERNEL32 ref: 0000000140073C07

ImpersonateLoggedOnUser.ADVAPI32 ref: 00000001400740DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 00000001400745C8
RevertToSelf.ADVAPI32 ref: 00000001400745E6

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: 78111f010a6ea5b5ae6ae8d162778a791ededbfc55de02017354f219b5f97645
Instruction ID: 725f3c8a4bb51d22fdc93160e2ff128e938ee97f23015ef30f5c7d66809f76c4
Opcode Fuzzy Hash: 78111f010a6ea5b5ae6ae8d162778a791ededbfc55de02017354f219b5f97645
Instruction Fuzzy Hash: D0227CB2B14B8086FB02DB6AD4543DD2761E79A7E4F505215FBAD07AEADB78C480D700

Function 000000014009AE38 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000014009AEB7
WriteFile.KERNEL32 ref: 000000014009B17F
WriteFile.KERNEL32 ref: 000000014009B1C5
GetLastError.KERNEL32 ref: 000000014009B27B

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0f4573ad5ab6b01d73635eec7536a5d729b1e7ad683b81b449e6e28c999a8dea
Instruction ID: c74fe89f61bfa30f28c8e94184cb44ca258f1dcc1b28fecb56b8b96372769064
Opcode Fuzzy Hash: 0f4573ad5ab6b01d73635eec7536a5d729b1e7ad683b81b449e6e28c999a8dea
Instruction Fuzzy Hash: AAD1E072B14A8489E712CFBAD5403EC37B1F358BE8F544216EF5A97BA9DA38C506C740

Function 000000014009B7F8 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000000014009B914
GetLastError.KERNEL32 ref: 000000014009B99F

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a8be48e25dcd1c4f8a4168961d870eb76e92b48431727c0765876aa17b118fd9
Instruction ID: 430cb94ec275b1b006606032aa0a0ac97a79295e9cf0530a9309411366c7b0e5
Opcode Fuzzy Hash: a8be48e25dcd1c4f8a4168961d870eb76e92b48431727c0765876aa17b118fd9
Instruction Fuzzy Hash: 85919F72710A9085FB629F6796803ED2BA4B74DBE8F544109EF4A67BA5DB38C482C701

Function 00007FF60807E0EA Relevance: 6.2, APIs: 4, Instructions: 217COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00007FF60807E204
GetLastError.KERNEL32 ref: 00007FF60807E28F

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 60a411c71040640233f3d61c6a9d19a4bd584ca0be3b067abe8c2bac933effdd
Instruction ID: 537547f5dcd806380750f9d2309ffc0a48ea00f5c122ddd58997917dcdf83b06
Opcode Fuzzy Hash: 60a411c71040640233f3d61c6a9d19a4bd584ca0be3b067abe8c2bac933effdd
Instruction Fuzzy Hash: 3E91BF72F0965289F764CF75C4452BD2BA0AB41B88F644179DE0FA6AC5DE38E482C70C

Function 00007FF608078A64 Relevance: 6.2, APIs: 4, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF608078B87
__AdjustPointer.LIBCMT ref: 00007FF608078BD2
__AdjustPointer.LIBCMT ref: 00007FF608078CA9

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 25fc134e6c63f0dacb96735037029e45b4d702db581d39d025ef25b43ec03c5f
Instruction ID: 5756d54971246d1bdff0b4c73555a4daf366951b2d4761798aca16d318fbad2f
Opcode Fuzzy Hash: 25fc134e6c63f0dacb96735037029e45b4d702db581d39d025ef25b43ec03c5f
Instruction Fuzzy Hash: F471C062E0AA4681FE65DA31958857D6794EF54B80F29C835DF4F87BC5DE3CE482830C

Function 0000000140088E10 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000000140088E30
FreeEnvironmentStringsW.KERNEL32 ref: 0000000140088F2B
RtlInitUnicodeString.NTDLL ref: 0000000140088F9E
RtlInitUnicodeString.NTDLL ref: 0000000140088FAB

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 03050de4473a7036840b3f814e3b1606e0f3ac0b841f86a6d84b765ac0863df6
Instruction ID: 249d8477ed98fc917396095c4ed7d3802801dfc0ba70534cb905eba45bdc7ad3
Opcode Fuzzy Hash: 03050de4473a7036840b3f814e3b1606e0f3ac0b841f86a6d84b765ac0863df6
Instruction Fuzzy Hash: 25519A72A14B8082EB228F16E44039D7361FB98BD4F549215EF9D03BA6DF78D6E1C704

Function 0000000140041C40 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400BAEAC: std::_Lockit::_Lockit.LIBCPMT ref: 00000001400BAEC9
Part of subcall function 00000001400BAEAC: std::locale::_Setgloballocale.LIBCPMT ref: 00000001400BAEEC

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041C81
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041CA6
std::_Facet_Register.LIBCPMT ref: 0000000140041D52
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140041DB4

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: eed450fc87f7b90693e9453fe6d78228114555bdcea7261450a71dd83f0eb7c1
Instruction ID: 236d6389257f28c7c4492d83038e332ebcfbc23cf179b41e14085838a707cd19
Opcode Fuzzy Hash: eed450fc87f7b90693e9453fe6d78228114555bdcea7261450a71dd83f0eb7c1
Instruction Fuzzy Hash: F8412732224B4081EB56DB56E8843DA73A4F78DBD4F595622BB9E07BB9DF38C442C704

Function 000000014008EFBC Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008F035
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F091
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F0CC
_invalid_parameter_noinfo.LIBCMT ref: 000000014008F0F1

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 86078050b35c3d83f66a5f3c361acaaa1e6b6eb617984a3c991cabd19b075f59
Instruction ID: ffa9c572a7e4a5e066940d6fcd93473eef70c18ca386996d5ac19e9d5ffa0d93
Opcode Fuzzy Hash: 86078050b35c3d83f66a5f3c361acaaa1e6b6eb617984a3c991cabd19b075f59
Instruction Fuzzy Hash: 0A413A77504A848AEB639F36D4103ED7BA0F749FC4F49C052EB88473A7DA398945DB12

Function 00000001400467E0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014004680B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140046830
std::_Facet_Register.LIBCPMT ref: 00000001400468DB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140046926

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 9372afe047aa4cc0eae63c1b6c1241976da657e1e17b1950321beacb823c7ea0
Instruction ID: a4e2e4869f216a93c3555fe410e8c924b94c3ccb6d48aa5672fd74940a3f9b6e
Opcode Fuzzy Hash: 9372afe047aa4cc0eae63c1b6c1241976da657e1e17b1950321beacb823c7ea0
Instruction Fuzzy Hash: CB414A32214B4081FB16DF67E4403D96760F78DBE8F591626AB8E477B5EE38C482CB15

Function 0000000140079A80 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140079AAB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140079AD0
std::_Facet_Register.LIBCPMT ref: 0000000140079B7B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140079BC6

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f43f1546969bcc0bc2afbc257653b84f1bc5d930af1f407b475991def0315af4
Instruction ID: 84f0272817a06c5c3477c8b36134a0f56f515ea9523122fac0f48a6a6587710e
Opcode Fuzzy Hash: f43f1546969bcc0bc2afbc257653b84f1bc5d930af1f407b475991def0315af4
Instruction Fuzzy Hash: 03413A32214A4085FB26DF67E9803D96764F78DBE8F581621AB8E47BB5DF3CC4428700

Function 0000000140043DD0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140043DFB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140043E20
std::_Facet_Register.LIBCPMT ref: 0000000140043ECB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140043F16

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: d3fce6e4a644a7405e72c1ab96fc402567e2800d73aaf2439b09d84a5f1f45ee
Instruction ID: 16fa0f5e4538a510978ef81ad45d7d3382f56bc736d23ff421205b4c4ce0a84b
Opcode Fuzzy Hash: d3fce6e4a644a7405e72c1ab96fc402567e2800d73aaf2439b09d84a5f1f45ee
Instruction Fuzzy Hash: 49415836215A4081FA26DF57E4403D9B7A0F79CBE4F591622BB9E477F9DE38C4828704

Function 00000001400B9CAC Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400B9CF5
GetLastError.KERNEL32 ref: 00000001400B9D03
WideCharToMultiByte.KERNEL32 ref: 00000001400B9D38
GetLastError.KERNEL32 ref: 00000001400B9D46

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 632c629cd5f3082fb104fc700d54a245379ea41028df2d6bfc62e537c178c61a
Instruction ID: 732770dae735fb1ee09a7bed1d2b51e1158dd485e33b6057137ecc77f848afbf
Opcode Fuzzy Hash: 632c629cd5f3082fb104fc700d54a245379ea41028df2d6bfc62e537c178c61a
Instruction Fuzzy Hash: 61215C76614B8587E7218F17E44435EBAB4F79DBC4F244129EB8993B69DB38C8018B00

Function 00000001400BA198 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B9AC8: GetModuleHandleW.KERNEL32 ref: 00000001400B9ADE
Part of subcall function 00000001400B9AC8: GetProcAddress.KERNEL32 ref: 00000001400B9AEE

GetLastError.KERNEL32 ref: 00000001400BA1BC

Part of subcall function 0000000140098174: IsProcessorFeaturePresent.KERNEL32 ref: 000000014009819A

GetFileAttributesW.KERNEL32 ref: 00000001400BA1CB
__std_fs_open_handle.LIBCPMT ref: 00000001400BA1F4
CloseHandle.KERNEL32 ref: 00000001400BA206

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: b1371cc999af6c120738bad54607841319b72b2770334362f7f3709bf50731cc
Instruction ID: 299d0bcef7e4c936e736a2796c6b4b3e96ec945ce56f71dcb84488a010b228e1
Opcode Fuzzy Hash: b1371cc999af6c120738bad54607841319b72b2770334362f7f3709bf50731cc
Instruction Fuzzy Hash: CD118635218A4045EB565FABE4843BA6671E74E7F0F105614FB7747AF5DA3DC4418B00

Function 00007FF608075304 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF608075330
GetCurrentThreadId.KERNEL32 ref: 00007FF60807533E
GetCurrentProcessId.KERNEL32 ref: 00007FF60807534A
QueryPerformanceCounter.KERNEL32 ref: 00007FF60807535A

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1ef9cfd6a28bfbf257edefedf7c8203de68038772214ee7f848650bd26ef0748
Instruction ID: aa8045bfd570cf42edd20c810431070e8ad32adfb0c7622d485ff57cfd20fb03
Opcode Fuzzy Hash: 1ef9cfd6a28bfbf257edefedf7c8203de68038772214ee7f848650bd26ef0748
Instruction Fuzzy Hash: 6A111C22B14B06CAEB00CBB0E8556A833A4F799768F580E31DA6DC77A4DFB8D1558344

Function 00000001400AE1C8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400AE1F4
GetCurrentThreadId.KERNEL32 ref: 00000001400AE202
GetCurrentProcessId.KERNEL32 ref: 00000001400AE20E
QueryPerformanceCounter.KERNEL32 ref: 00000001400AE21E

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 994afb034ad63c778ea227749b14eccab6c02e75851fdf0a55821c6d844240c7
Instruction ID: 2d033e041bdf3d7227269b0f70d14b42616edc8a7a419766452458ae47f0e022
Opcode Fuzzy Hash: 994afb034ad63c778ea227749b14eccab6c02e75851fdf0a55821c6d844240c7
Instruction Fuzzy Hash: 5011FA36710F008AEB01CFA1E8553A833A4F75DB68F441E25EB6D477A4DF78C1A58350

Function 000000014002EBF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000000014002ED2B

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 1ba8e3da2909c054d39c44023fbe7e7d0f6878c7ac68f1147c079845afd3f212
Instruction ID: 6b50a091b2802ad2945aeadc0d55fe758afa20c7301277ed6e57d09efbd5c6ee
Opcode Fuzzy Hash: 1ba8e3da2909c054d39c44023fbe7e7d0f6878c7ac68f1147c079845afd3f212
Instruction Fuzzy Hash: FC71E272F10B9085FB01CB7AE8413DD67A1E799BD4F644226EF5917BAADB78C482C340

Function 00000001400B1700 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001400B172A

Strings

csm, xrefs: 00000001400B174F
csm, xrefs: 00000001400B18BE

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: d612173bfaa8a2380fe5b48d2d485991192f6fc7e1eabacda55b96e47468999e
Instruction ID: 732827d43b81279fc09f351b0f2266c69a4f1640728df4e45fd91df2211a6454
Opcode Fuzzy Hash: d612173bfaa8a2380fe5b48d2d485991192f6fc7e1eabacda55b96e47468999e
Instruction Fuzzy Hash: 80718176204AC086EB628F66D4507ED7BB0F788BC5F548216FF8857AADCB38C591CB41

Function 00000001400AF15C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001400AF187
RtlUnwindEx.KERNEL32 ref: 00000001400AF278

Strings

csm, xrefs: 00000001400AF205

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: Unwind__except_validate_context_record
String ID: csm
API String ID: 2208346422-1018135373
Opcode ID: 66bbef8c19356e990cfb8f89928e01c6fdd1ce5aed4229e3d09978b89fbc63e4
Instruction ID: 89e5e8f779c4e8b204e1a98a4adc9b963e8ad9f1d18d37424198852836f041da
Opcode Fuzzy Hash: 66bbef8c19356e990cfb8f89928e01c6fdd1ce5aed4229e3d09978b89fbc63e4
Instruction Fuzzy Hash: 2051E6363116018AEB55CF96E044BBC33A5F76CBD8F508221FB5A477A8DB79C981DB00

Function 000000014007A000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007A06F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014007A0B7

Strings

bad locale name, xrefs: 000000014007A18C

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 28d15cfe3afaff4e70186dc69545f2dcaf145971d976bdeeb826c8756c6efb46
Instruction ID: 808e80a19e9a8367672ecaf7a1c34fe7cc6f7304543fb875a4e8aeb018317e5d
Opcode Fuzzy Hash: 28d15cfe3afaff4e70186dc69545f2dcaf145971d976bdeeb826c8756c6efb46
Instruction Fuzzy Hash: F2518C32711A0089FB16EFB2D4913ED33B5EB88B88F484425FF4967AA5DE39C925C344

Function 0000000140049500 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014004956F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400495B7

Strings

bad locale name, xrefs: 0000000140049696

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 53b0fcf59b7055776f2f4b1ce98978138a0590209bea8aaf15bd716caedf58d6
Instruction ID: 1c6d693c5901f9d80c69387f4c3a86c5155362670e00a8e852182763da2cabe9
Opcode Fuzzy Hash: 53b0fcf59b7055776f2f4b1ce98978138a0590209bea8aaf15bd716caedf58d6
Instruction Fuzzy Hash: EE514B32302B4089EB16DFB2D4903EC33B5EB58788F454535FB4967AA5DE34C965D348

Function 00000001400A1618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A69F8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A6A2B

_get_daylight.LIBCMT ref: 00000001400A1730
_get_daylight.LIBCMT ref: 00000001400A1741

Strings

?, xrefs: 00000001400A16C1

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 3ba78745508b718642018cf518253b0996b099e50045ac97e9606100fafa35be
Instruction ID: f30818a0088620f31da01904ea9adbefb6569b303ba16c750db778e40d9abdaf
Opcode Fuzzy Hash: 3ba78745508b718642018cf518253b0996b099e50045ac97e9606100fafa35be
Instruction Fuzzy Hash: 9041E33261478046FB669B27E5113EE6AA0E7E8BE4F144325BF9847AF5DB38C4C18F00

Function 00000001400B1DF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001400B1E9A
_CreateFrameInfo.LIBVCRUNTIME ref: 00000001400B1EC3

Strings

csm, xrefs: 00000001400B1FC3

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 30dd612b4e4b9212e9166655247be16b5f23695bfc4863c6a6ebc2986465c29c
Instruction ID: 3dac7b5d3b0d881bcd455e3888886abadacebbcbcc28f580a094f6440ece58b6
Opcode Fuzzy Hash: 30dd612b4e4b9212e9166655247be16b5f23695bfc4863c6a6ebc2986465c29c
Instruction Fuzzy Hash: AB510677615B4086E661AF66E4403AE77B4F38DBD0F540225AF890BB66CF38D4A2CB00

Function 00007FF60807EBA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF60807ECBF
GetLastError.KERNEL32 ref: 00007FF60807ECE1

Strings

U, xrefs: 00007FF60807EC6B

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4a2143aea001407eb2cc82c9df801d17e9c15ad72bb50a2a20f8f3de8da8662b
Instruction ID: e5fa4db588a15c04eaa171f03ee741d8df3e0027dc38ee080bc088217e56b635
Opcode Fuzzy Hash: 4a2143aea001407eb2cc82c9df801d17e9c15ad72bb50a2a20f8f3de8da8662b
Instruction Fuzzy Hash: 0B41B262B19B4185EB20CF35E4443A967A0FB98B94FA44031EE4EC7798DF7CD442C748

Function 000000014009B4D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014009B5E7
GetLastError.KERNEL32 ref: 000000014009B609

Strings

U, xrefs: 000000014009B593

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 7b6b0220355e4baf3ced440fd77bc49a04f673044c496e04ac13764c72edacc7
Instruction ID: e6320d284cb9a528543140e404914897430357409d217e9d910f130c428e9124
Opcode Fuzzy Hash: 7b6b0220355e4baf3ced440fd77bc49a04f673044c496e04ac13764c72edacc7
Instruction Fuzzy Hash: 44419F72214A8082DB219F26E4443EA77A1F798BD4F414121EF4D877A8EB7CC441CB40

Function 00007FF6080759E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF608074E57), ref: 00007FF608075A30
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF608074E57), ref: 00007FF608075A71

Strings

csm, xrefs: 00007FF608075A5E

Memory Dump Source

Source File: 00000001.00000002.1850766765.00007FF608071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF608070000, based on PE: true

Associated: 00000001.00000002.1850748372.00007FF608070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608083000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850791471.00007FF608387000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850961285.00007FF60838D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF60838F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1850982029.00007FF608392000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1851024617.00007FF608394000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff608070000_soft 1.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 967fbbe814c9c1e701ed63cdd0d532d980ddcea8b093fe1b68fbd27a0b08e2d1
Instruction ID: 3663f0858507ac6a770d823c2188b2fb1595d4125fae17c7c3bd45300161abc4
Opcode Fuzzy Hash: 967fbbe814c9c1e701ed63cdd0d532d980ddcea8b093fe1b68fbd27a0b08e2d1
Instruction Fuzzy Hash: 20116032A18B8182EB20CF25F840259B7E5FB88B94F684230DE8D47759DF3CD551C704

Function 00000001400AF748 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001400AF798
RaiseException.KERNEL32 ref: 00000001400AF7D9

Strings

csm, xrefs: 00000001400AF7C6

Memory Dump Source

Source File: 00000001.00000002.1849529317.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_soft 1.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 8fa98aa95e9aae2a90a459b42b1f704c9c51d3f3bc5b4355a873c03fa23ea9e8
Instruction ID: 2cd2fca06ac07b3d24a383fcaf9b1e00f30e6730416406c57118f0930f6fa0f4
Opcode Fuzzy Hash: 8fa98aa95e9aae2a90a459b42b1f704c9c51d3f3bc5b4355a873c03fa23ea9e8
Instruction Fuzzy Hash: 8011D736219B8082EB628F26E44039D77E5FB98BD4F584225EB8D07768DF3CC5918B40

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report soft 1.14.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
soft 1.14.exe

Function 00007FF608079B9C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Function 00007FF608074340 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 145
COMMON

Function 00007FF608074F3C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94
COMMON

Function 00007FF6080799F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Function 00007FF608076824 Relevance: 4.5, APIs: 3, Instructions: 14
COMMONLIBRARYCODE

Function 00007FF60807AFC8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
COMMON

Function 00007FF60807A8C8 Relevance: 3.2, APIs: 2, Instructions: 194
COMMON

Function 00007FF608074E38 Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Function 00007FF60807B380 Relevance: 3.0, APIs: 2, Instructions: 19
memoryCOMMONLIBRARYCODE

Function 00007FF60807671C Relevance: 1.6, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Function 00007FF60807D464 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FF608074630 Relevance: 1.5, APIs: 1, Instructions: 28
processCOMMON

Function 00007FF6080726F0 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Function 00007FF608074C44 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre